Job Description

We are seeking an experienced cybersecurity professional to join our team as a vCISO Consultant. This role combines hands-on cybersecurity expertise, security program leadership, client advisory responsibilities, and virtual Chief Information Security Officer (vCISO) services.

The ideal candidate is a well-rounded security professional with strong technical breadth who has progressed beyond a purely individual-contributor role into leadership, program management, architecture, or security management responsibilities. This individual may currently be a Security Manager, Security Architect, Senior Security Engineer, Senior Security Analyst, Security Program Manager, or similar security professional who is ready to take the next step into a consulting and executive advisory position.

Previous consulting experience is preferred but not required. We are open to candidates who demonstrate strong consulting aptitude, executive presence, leadership capabilities, and the ability to manage and influence stakeholders but have not yet held a formal consulting role.

Previous experience as a CISO is also not required. We are looking for someone with the experience, judgment, communication skills, and security expertise to develop into a trusted vCISO for our clients.

The successful candidate will work across strategic and technical cybersecurity engagements, helping clients assess risk, strengthen security programs, establish cybersecurity roadmaps, improve technical environments, address compliance requirements, and communicate cybersecurity priorities to executives and other stakeholders.

Key Responsibilities

vCISO & Executive Security Leadership

• Serve as a trusted cybersecurity resource to client leadership, including IT leaders, executives, business stakeholders, and, as appropriate, Boards of Directors.
• Support and progressively lead vCISO engagements, helping clients establish cybersecurity strategy, priorities, governance, and security program direction.
• Translate technical cybersecurity risks and findings into clear business impact, recommendations, and priorities.
• Lead and facilitate cybersecurity risk discussions with CEOs, CFOs, CIOs, IT leaders, and other senior stakeholders.
• Develop and deliver executive-level security reporting, metrics, risk summaries, and program updates.
• Help clients make informed decisions regarding cybersecurity investments, priorities, risk acceptance, and remediation.
• Develop trusted client relationships and operate as an extension of the client's leadership team.

Security Program Development & Leadership

• Help clients build, mature, and manage cybersecurity programs based on business needs, risk profiles, industries, and regulatory requirements.
• Develop and maintain security policies, standards, risk registers, cybersecurity roadmaps, governance structures, and security committee cadences.
• Establish meaningful cybersecurity metrics and reporting that provide leadership with visibility into security posture, risks, and progress.
• Evaluate existing cybersecurity programs, identify maturity gaps, and develop practical and prioritized improvement plans.
• Provide program leadership across security initiatives involving technical teams, business stakeholders, vendors, and executives.
• Balance security best practices with business objectives, available resources, organizational maturity, and risk tolerance.

Cybersecurity Assessments & Technical Consulting

• Lead cybersecurity assessments and consulting engagements from initial scoping through final executive presentation.
• Own end-to-end engagement delivery, including scoping, work planning, discovery, execution, technical analysis, findings, recommendations, remediation planning, and executive readouts.
• Assess client environments across cybersecurity domains including networking, cloud security, security architecture, application security, identity and access management, vulnerability management, governance, risk, and compliance.
• Apply knowledge of application security concepts, including secure SDLC practices, OWASP principles, and API security.
• Maintain broad technical knowledge across cybersecurity disciplines while providing deeper expertise in one or more security domains.
• Work effectively with client technical teams to understand complex environments and translate findings into actionable recommendations.
• Identify opportunities to further strengthen client security programs based on assessment findings and business priorities.

Governance, Risk & Compliance

• Apply recognized cybersecurity and compliance frameworks to assess client environments and establish security priorities.
• Work with frameworks and standards such as NIST CSF 2.0, NIST SP 800-53, NIST SP 800-171, CIS Controls, CMMC, SOC 2, ISO 27001, and FFIEC.
• Help clients translate regulatory, compliance, and framework requirements into practical security initiatives.
• Support the development of risk registers, remediation plans, policies, security roadmaps, metrics, and executive reporting.
• Assist clients with preparation for audits, assessments, certifications, customer security requirements, and regulatory examinations as appropriate.
• Apply a risk-based approach to security and compliance rather than a checklist-driven approach.

Client & Engagement Management

• Build trusted relationships with client stakeholders ranging from technical SMEs and security teams to IT directors and executives.
• Manage multiple concurrent client relationships and engagements while maintaining organization, responsiveness, and quality.
• Context-switch effectively between clients, industries, technical environments, and security challenges.
• Navigate technical disagreements, client concerns, and stakeholder pushback professionally while maintaining credibility and strengthening client relationships.
• Maintain discipline around project scope, timelines, deliverables, budgets, and time tracking.
• Communicate proactively regarding engagement progress, risks, dependencies, and next steps.
• Identify additional client needs and appropriate follow-on opportunities based on security risks, assessment results, and business objectives.

Leadership & Team Development

• Provide leadership, guidance, and mentorship to junior consultants and technical team members.
• Review security assessments, findings, recommendations, and client deliverables for technical accuracy, quality, consistency, and business relevance.
• Help define project scope, estimate effort, develop work plans, and determine appropriate project staffing.
• Coordinate with technical specialists and other consultants to deliver cohesive client solutions.
• Share cybersecurity expertise and contribute to the development of consulting methodologies, assessment frameworks, and client deliverables.

Required Qualifications

• Approximately 7+ years of progressive cybersecurity experience, including meaningful experience beyond a purely individual-contributor role.
• Broad knowledge across cybersecurity domains, technologies, risks, and industry best practices.
• Professional experience in roles such as Security Analyst, Security Engineer, Security Architect, Security Manager, Security Program Manager, or similar cybersecurity positions.
• Demonstrated progression into security leadership, program ownership, project leadership, architecture, management, or stakeholder-facing responsibilities.
• Experience leading cybersecurity initiatives or programs involving multiple teams and stakeholders.
• Demonstrated ability to manage, lead, and influence, including situations where direct authority is limited.
• Experience assessing security environments and developing practical, prioritized recommendations for improving security posture and maturity.
• Working knowledge of recognized security and compliance frameworks, including several of the following: NIST CSF 2.0, NIST SP 800-53/171, CIS Controls, CMMC, SOC 2, ISO 27001, and FFIEC.
• Strong written, verbal, presentation, and interpersonal communication skills.
• Ability to communicate effectively with both highly technical audiences and business executives.
• Ability to manage multiple projects, priorities, stakeholders, and deadlines simultaneously.
• Strong professional judgment, critical thinking, curiosity, and problem-solving skills.
• Executive presence and the ability to develop into a trusted vCISO for clients.

Preferred Qualifications

• Experience as a Security Manager, Security Architect, Security Program Manager, or senior security practitioner with leadership responsibilities.
• Experience building or significantly improving a cybersecurity program, including policies, risk management processes, security roadmaps, governance, metrics, and executive reporting.
• Experience presenting cybersecurity risks, recommendations, assessments, or program updates to senior leadership.
• Experience mentoring, reviewing, or leading the work of other cybersecurity professionals.
• Project or program management experience, including defining scope, developing work plans, managing timelines, coordinating resources, and delivering outcomes.
• Deep expertise in at least one cybersecurity domain combined with broad knowledge across multiple security disciplines.
• Previous customer-facing, professional services, consulting, or advisory experience is beneficial but not required.
• Relevant cybersecurity certifications are beneficial but not required.

Previous experience as a CISO, deputy CISO, vCISO, or professional consultant is not required. Candidates who demonstrate the technical credibility, leadership experience, executive presence, communication skills, and aptitude to grow into the role are encouraged to apply.

What Success Looks Like

Success in this role requires the ability to bridge technical cybersecurity expertise, program leadership, business risk, and executive communication.

The successful candidate will be comfortable discussing security architecture and technical findings with engineers while also translating those issues into business risks, priorities, and investment decisions for executives.

Initially, this individual may partner with experienced consultants on complex vCISO engagements while independently leading assessments, projects, and client discussions within their areas of expertise.

As the individual develops, they will take on increasing responsibility for client relationships and vCISO engagements, ultimately serving as the trusted security leader for multiple clients.

The ideal candidate is someone who understands how security works technically, knows how to lead security programs, can influence people and decisions, and has the executive presence to represent cybersecurity at the leadership level.