The Cybersecurity Consultant (L3) is an advanced consulting position focused on evaluating cybersecurity risk, the effectiveness of controls, compliance posture, and cloud security across client environments.

The main purpose of this role is to independently design and execute security assessments, uncover control gaps and vulnerabilities, and deliver clear, evidence-driven recommendations to support risk treatment and compliance objectives.

The Cybersecurity Consultant (L3) works on sophisticated security risk assessments,IM8/security compliance, vulnerability assessment (VA), security configuration review, audit, cloud security posture management (CSPM), incident management, vulnerability management and cloud security. The consultant must maintain a sufficient level of independence from the personnel responsible for implementing the controls being assessed.

As needed, this role may also contribute to or support project delivery.

Key Responsibilities:

. Plans and executes cybersecurity risk assessments spanning infrastructure, applications and cloud environments.

. Evaluates compliance against IM8and other relevant security requirements, using documented evidence and established assessment criteria.

. Conducts vulnerability assessments and security configuration reviews, interprets results, and verifies risk and remediation priorities.

. Assists with security audits by developing assessment plans, examining supporting evidence, recording observations and managing findings through to closure.

. Reviews cloud security posture using CSPM findings and assesses cloud security risks and control gaps.

. Supports incident management activities, including evaluating security impact, coordinating responses, and documenting outcomes.

. Coordinates vulnerability management efforts, including review, prioritisation, remediation status tracking and risk acceptance input.

. Creates detailed assessment reports covering scope, evidence, findings, risk impact and recommended corrective actions.

. Sustains sufficient independence from personnel implementing the controls being assessed and raises any potential conflicts of interest.

. Shares assessment results and security risks with client stakeholders and relevant delivery teams.

. Monitors assigned actions and deliverables, ensuring completion within agreed timelines and service requirements.

. Participates in knowledge sharing, assessment templates, and continuous enhancement of cybersecurity consulting practices.

. Performs any other related task as required.

Knowledge and Attributes:

. Ability to work independently and remain objective when evaluating control design and operating effectiveness.

. Strong analytical capability to link technical findings to security, risk and compliance outcomes.

. Skill in clearly explaining complex cybersecurity risks to both technical and non-technical stakeholders.

. Strong report writing, evidence review and stakeholder management capabilities.

. Ability to operate effectively across different cultures and social groups.

. Capability to plan activities in advance and adjust to changing circumstances.

. Ability to perform well in a fast-paced, pressurised environment while maintaining quality and sound professional judgement.

. Strong client service mindset and dedication to precise, evidence-based results.

Academic Qualifications and Certifications:

. Bachelor's degree or equivalent qualification in IT/Computing (or proven equivalent work experience).

. Certifications relevant to the services provided carry additional weightage on a candidate's qualification for the role.

. Required certification(s):

. CISSP, CRISC, or equivalent certification.

. Good-to-have certification(s):

. CISA.

. CGEIT.

. AWS Certified Security -Specialty.

Required Experience:

. 6+ years of overall relevant experience.

. 5+ years of experience in Cybersecurity Consulting, Risk, Compliance, VA and Cloud Security.

. Proven experience in security risk assessment, IM8/security compliance, VA, security configuration review, audit, CSPM, incident management, vulnerability management and cloud security.

. Demonstrated ability to carry out assessments independently from personnel implementing the controls being assessed.