This is a remote position.
This is a hands-on role. We are not looking for someone to only advise us and leave the work to our team: you will do a large part of the security work yourself, working inside our repositories, pipelines and cloud accounts alongside our engineers. You will configure tools, fix and harden things, write the processes and documents, and run the sessions, while showing our team how it is done along the way.
Our goal is a company that runs a secure development lifecycle on every project, has its own house in order, is well on the way to ISO/IEC 27001 certification, and has an internal Security Lead who can work with you and gradually take over day-to-day ownership. This is a part-time role.
Responsibilities
Assessment and governance
- Run the security maturity assessment yourself (for example OWASP SAMM), review our repositories, pipelines and cloud setup, and turn the findings into a prioritized roadmap.
- Write our core security policies and procedures: access control, acceptable use, secure development, incident response, vendor and AI tool usage.
- Set up and maintain the security backlog, risk register and progress metrics, and report progress to management monthly.
Company security ("secure the house")
- Configure and enforce SSO and MFA across email, Git hosting, cloud consoles, CI/CD and Passbolt.
- Review and fix access rights, and set up onboarding and offboarding checklists.
- Harden our Passbolt setup and implement a secrets manager for applications and pipelines, including migrating existing secrets out of code and CI variables.
- Implement baseline hardening for laptops, cloud accounts, backups and logging.
- Write the incident response plan and run tabletop exercises with the team.
Secure software development
- Build our standard Secure SDLC, based on OWASP ASVS and OWASP SAMM, and roll it out on real client projects.
- Configure and tune our SecOps platform: reduce false positives, set up pipeline quality gates and triage findings together with the teams.
- Add the missing scanning to our CI/CD pipelines yourself: SAST, SCA, secrets scanning, IaC and container scanning, DAST and SBOM generation.
- Run threat modeling sessions on active projects and document the results.
- Do security code reviews of high-risk changes and help developers fix vulnerabilities.
- Perform internal security testing of our applications before releases, and scope and coordinate external penetration tests.
Regulation and compliance
- Map how the EU Cyber Resilience Act (CRA), NIS2 and relevant local regulations affect us and our clients.
- Write and implement our vulnerability handling and disclosure process, including support for clients' CRA reporting obligations.
- Do the hands-on ISO/IEC 27001 preparation work: scope, risk assessment, Statement of Applicability, policies and evidence, and work with the certification body.
Client offering
- Help define security service tiers we can include in client proposals.
- Fill in client security questionnaires and build a reusable answer set.
- Join selected client meetings or calls as a senior security voice when needed.
People and knowledge
- Work side by side with our internal Security Lead so they learn by doing.
- Run short internal workshops on key topics (for example OWASP Top 10, threat modeling, secure CI/CD).
- Recommend training and certification paths for developers, Security Champions and DevOps engineers.
Requirements
Must have
- 8+ years of experience in information security, with recent hands-on work in application security, DevSecOps or cloud security.
- Comfortable doing the work yourself: configuring security tools, writing pipeline configuration, reviewing code, testing applications and writing policies.
- Practical experience setting up a secure development lifecycle and integrating security tools into CI/CD pipelines.
- Good knowledge of cloud security in at least one major cloud (AWS, Azure or GCP).
- Ability to explain security risks in plain language to both engineers and management.
- Fluent English, written and spoken.
- Kubernetes and container security experience.
- Knowledge of security risks in AI and LLM-based applications.
Nice to have
- Experience with the EU Cyber Resilience Act, NIS2 and GDPR in a software vendor or supplier context.
- Experience building security offerings for clients in an agency or outsourcing environment.
- Experience implementing or auditing ISO/IEC 27001 (or a comparable framework such as SOC 2).
Certifications (one or more preferred)
- Hands-on certifications such as OSCP, BSCP, CDP or CKS
- ISO/IEC 27001 Lead Implementer or Lead Auditor
- Cloud security certification (AWS Security Specialty, AZ-500 or Google Professional Cloud Security Engineer)
- CISSP, CISM or CSSLP
The Secret Ingredients That Make Us Special:
- Your growth is our growth. We invest in your future with paid training and other professional opportunities.
- We're industry innovators at the forefront of change. Equipped with the latest technologies and a team of knowledgeable colleagues by your side, you'll embrace new and interesting challenges.
- Your location. Your schedule. Pick your time zone, choose your preferred hours, and work from the place where you feel most at home.
- Flexibility and freedom are in our DNA! As long as you have a stable internet connection and the drive to thrive, you can travel and work from anywhere you like.
- A workload you can rely on. We'll set you enough tasks to keep that mind busy! At Scopic, we'll ensure you always have a consistent flow of engaging, challenging work to do.
- Recognition and reward. We acknowledge diligence and hard work through annual pay increases for good performance.
Down to Business!
- Your starting rate is negotiable depending on your skills and experience.
- This is an hourly paid position.
- Contractors are paid monthly via wire transfer.
Our Values:
Scopic is an equal-opportunity employer. We value diversity and do not discriminate on the basis of race, religion, color, marital status, national origin, gender, veteran status, sexual orientation, age, or disability status.
Have the skills, the drive, and the passion to join the Scopic family? Apply today to join our growing team of remote professionals from around the world.
Terms of Application
By submitting an application:
- I consent that the data provided in this form, and the attached CV, will be used for Scopic's recruiting purposes and email communications.
- I consent to Scopic conducting an identity verification process as part of the hiring process. I understand that my personal information may be collected and processed for the purpose of verifying my identity in compliance with applicable laws.
