Information Security Consultant

About the role

We are seeking an experienced Information Security Consultant to join Cytomate’s Cybersecurity, Risk and Compliance Advisory team. In this client‑facing position you will lead and support security governance, risk, compliance and assurance engagements across multiple industries, working closely with senior management and technical teams.

Key responsibilities

• Lead and support cybersecurity governance, risk, compliance and assurance engagements, including gap, maturity and risk assessments, internal audits and certification‑readiness reviews.
• Design, implement and continuously improve Information Security Management Systems aligned with ISO/IEC 27001 and other frameworks such as NIA, QCSF, NIST CSF, CIS Controls, ISO 22301 and PCI DSS.
• Develop and review security policies, procedures, standards and governance artefacts, including risk registers, treatment plans, Statements of Applicability, compliance matrices and remediation roadmaps.
• Assess the design and operating effectiveness of controls across access management, cloud security, vulnerability management, incident response, third‑party risk, security operations, business continuity and disaster recovery.
• Support data‑privacy compliance activities such as privacy gap assessments, data mapping, Records of Processing Activities, DPIAs, data‑subject rights handling and cross‑border transfer controls.
• Assist with AI governance and ISO/IEC 42001 implementation, covering AI inventories, risk classification, impact assessments, responsible‑use policies and lifecycle controls.

Required profile

• Proven experience delivering information‑security, cyber‑risk and regulatory‑compliance projects in a client‑facing environment.
• Strong analytical and documentation abilities with a track record of producing high‑quality security artefacts.
• Excellent stakeholder‑management skills, capable of interacting with senior business leaders and technical teams.
• Ability to manage multiple projects simultaneously and drive practical security solutions.

Required skills

• ISO/IEC 27001 implementation and certification
• NIST Cybersecurity Framework (NIST CSF)
• CIS Controls
• PCI DSS compliance
• ISO 22301 Business Continuity Management
• ISO/IEC 42001 AI Governance
• Cloud security concepts
• Vulnerability management processes
• Incident response planning
• Access management controls
• Third‑party risk assessment
• Data‑privacy regulations (GDPR‑style) and DPIA execution