IT Security Consultant: Secure by Design (m/f/d)

Right now, the wave of AI-ready cyber resilience and EU regulations (NIS2, DORA, EU CRA, EU AI Act) is reshaping how every large organisation in Europe approaches cybersecurity. Our Secure by Design practice is at the heart of this shift and takes it a step further: Compliance with regulatory requirements is a given for us, sustainable technical implementation is what we pride ourselves on: outcome-based rather than hour-based, knowledge-focused rather than leverage-focused, product-led rather than slide-led.

To continue meeting our clients’ needs whilst maintaining our quality standards, we are seeking experienced Secure by Design Consultants to help shape our scale.

THE ROLE

• You run threat modelling workshops together with product or platform teams and advise decision-makers strategically on Secure-by-Design.
• You analyze complex cloud, software and AI architectures, improve technical and organisational processes, and controls to derive measurable key risk indicators (KRIs).
• You contribute hands‑on by integrating security tools into CI/CD pipelines, optimizing Secure SDLC processes, and confidently working with infrastructure code when needed.
• You present and facilitate discussions confidently with both technical and non-technical stakeholders.
• You’re part of an interdisciplinary team and actively shape the development of our practice areas.

YOUR PROFILE

Must haves

• At least 3 years’ experience in cybersecurity, for example in consulting, cloud, or software engineering
• Practical experience running security risk assessments and producing security plans or concepts that engineering teams actually used
• Solid hands‑on knowledge in at least one of: cloud security (AWS / Azure / GCP), threat modelling, application security, CI/CD security tooling
• Confident in front of a client — running a workshop, presenting findings, writing for a CISO or product-owner audience
• Clear written and spoken English
• German at B2 or higher
• Familiarity with the EU Cyber Resilience Act (CRA) or EU AI Act
• Experience with a recognised risk‑assessment method (ISO 27005, NIST 800‑30, FAIR, BSI-Standard 200‑3)
• A cloud security certification (AWS / Azure / GCP security specialty, or CCSP)
• Kubernetes, Infrastructure as Code (Terraform), container security
• Open source contributions, a blog, talks or any portfolio of how you think

WHY CLOUDYRION

• We support EU Blue Card sponsorship and offer a relocation package for international hires
• 30 days of vacation plus additional days off on Christmas, New Year’s Eve, and your birthday
• Hybrid work with two remote days per week, trust‑based working hours and the opportunity of workations in any EU country
• Individual learning and development opportunities, including full coverage of advanced trainings, certification costs, and educational leave for exam days
• In‑house gym, massage chairs, gaming area, and dedicated break spaces
• Regular team events and plenty of space for real collaboration

You can find information on data protection during the application process at CLOUDYRION here.

Katharina - People & Culture

#J-18808-Ljbffr