Senior Cyber Security Risk Assessment Consultant – DAST

Senior Cyber Security Risk Assessment Consultant – DAST / SAST/ OWASP

Location: Brussels , Paris, London or Amsterdam

Contract: Long-term contract

Working Model: Hybrid

Hiring: Multiple positions available

The Opportunity

We are looking for experienced Senior Cyber Security Risk Assessment Consultants to join a major Cyber & Information Security function within a global financial services environment.

You will provide security expertise across a broad portfolio of business and technology projects, working closely with architects, engineers, developers, project teams, risk management and business stakeholders.

A key part of the position is performing technical security risk assessments, translating identified risks into security requirements, reviewing and validating solution designs, and defining appropriate security testing requirements.

This is not a SOC or purely operational security role. We are looking for experienced security professionals who can understand complex technical solutions, identify security risks and vulnerabilities, and advise projects on the controls required to achieve Secure by Design.

Key Responsibilities

• Perform security risk assessments across business and IT projects.
• Identify threats, vulnerabilities, security weaknesses and potential impacts within proposed solutions.
• Translate security architecture, policies, risks and controls into clear functional and technical security requirements.
• Define and advise on the design, implementation and testing processes required to protect information systems and assets.
• Embed Secure by Design principles throughout the technology delivery lifecycle.
• Contribute to architectural and solution design discussions and validate designs against security requirements.
• Review applications, platforms and infrastructure from a security perspective.
• Define application security testing requirements, including appropriate use of DAST, SAST, code scanning and penetration testing.
• Define penetration-testing scope and work closely with security-testing teams throughout execution.
• Review security-testing and penetration-testing reports and assess whether identified risks have been appropriately addressed.
• Apply OWASP principles and guidelines when assessing application security.
• Identify security gaps and recommend appropriate remediation and compensating controls.
• Produce and maintain security standards, principles, baselines and documented security requirements.
• Recommend new or improved security services and controls.
• Act as a Security Subject Matter Expert for project and business teams.
• Present security risks, findings and recommendations clearly to both senior stakeholders and deep technical specialists.
• Work closely with Business Owners, Business Analysts, Project Managers, Risk Management, Architects, Developers, Engineers and internal/external auditors.

Application Security / DAST / OWASP

We are particularly interested in candidates with strong knowledge of Application Security and experience across areas such as:

• OWASP Top 10 and wider OWASP security principles
• DAST / Dynamic Application Security Testing
• SAST / Static Application Security Testing
• Secure SDLC / Secure by Design
• Application vulnerability assessment
• Web application security
• API security
• Code scanning and security-analysis tooling
• Penetration-testing methodology and scoping
• Security testing and test-result validation
• CI/CD security controls
• DevSecOps
• Security and compliance automation

You do not need to be a hands-on penetration tester, but you should have sufficient technical knowledge to define security-testing requirements, scope appropriate testing, challenge findings and determine whether security risks have been adequately addressed.

Broader Security Knowledge

Alongside application security, candidates should bring knowledge across one or more additional Cyber & Information Security domains, which could include:

• Identity & Access Management / IAM / IDaaS
• PAM, authentication, authorisation and federation
• PKI, cryptography, encryption and key management
• Network and DMZ security
• WAFs and network segmentation
• Endpoint and platform se