Cybersecurity Consultant

We work with clients globally to strengthen their security posture, protect critical information assets, and address evolving cybersecurity challenges. Through our expertise and technology-driven approach, we help organizations build resilient and secure business environments.

About the Role

Arancia is seeking an experienced Cyber Security Consultant to deliver virtual CISO (vCISO) services, Threat and Risk Assessments (TRAs), Enterprise Risk Assessments (ERAs), and other risk-focused engagements for our clients.

You will act as a trusted security advisor to client leadership. That means helping clients understand their threat landscape and risk exposure, setting security strategy and priorities, and guiding them through governance, compliance, and remediation. You will own client engagements end to end, from scoping and fieldwork through to executive-ready reports and presentations.

The ideal candidate brings deep risk assessment experience, strong knowledge of security and risk frameworks, and the ability to explain risk in business terms to boards, executives, and technical teams alike. You will also mentor junior consultants and help shape Arancia's methodologies.

Key Responsibilities

Virtual CISO (vCISO) Services

* Serve as a fractional CISO for clients, acting as their senior security advisor to executives, boards, and IT leadership.
* Develop, implement, and maintain information security strategies, programs, and multi-year roadmaps aligned to business objectives and risk appetite.
* Establish and maintain security governance, including policies, standards, procedures, and security committee structures.
* Report on security posture, key risk indicators, and program metrics, and present recommendations to senior leadership and boards.
* Advise on security budgets, resourcing, vendor and third-party risk, and security tooling decisions.
* Guide clients through incident response planning and readiness, and provide advisory support during security incidents.

Threat and Risk Assessments (TRAs)

* Lead TRAs for applications, systems, cloud platforms, integrations, and new initiatives, including privacy- and health-sector submissions.
* Identify assets, threats, vulnerabilities, and existing safeguards, then rate inherent and residual risk using recognized methodologies.
* Assess emerging technology risk, including AI and LLM-based systems, using frameworks such as the NIST AI RMF.
* Produce formal TRA reports with prioritized, practical risk treatment recommendations.

Enterprise Risk Assessments (ERAs)

* Lead organization-wide cybersecurity risk and maturity assessments against frameworks such as NIST CSF 2.0, ISO/IEC 27001/27002, and CIS Controls.
* Interview stakeholders across the business, review documentation and evidence, and assess current versus target maturity.
* Build and maintain enterprise risk registers and risk treatment plans.
* Deliver maturity scorecards, gap analyses, and strategic roadmaps to executive and board audiences.

Other Threat and Risk Assessments

* Conduct third-party and vendor risk assessments, business impact analyses, and security architecture reviews.
* Perform threat modelling and analyze the client's threat landscape to inform risk ratings and priorities.
* Coordinate with technical assessment teams (e.g., penetration testing, vulnerability assessment) and incorporate their results into risk findings.

Governance, Risk and Compliance

* Help clients align with industry standards and regulations such as NIST CSF, ISO/IEC 27001, PCI DSS, HIPAA, SOC 2, and applicable Canadian privacy legislation (e.g., PIPEDA, PHIPA).
* Support business continuity, disaster recovery, and incident response planning and tabletop exercises.
* Deliver security awareness guidance and training to client staff and leadership.

Engagement Leadership

* Own client engagements end to end, including scoping, planning, fieldwork, reporting, and executive presentations.
* Manage multiple concurrent engagements and deliver high-quality work on time and within scope.
* Mentor junior consultants and review their work for quality.
* Contribute to Arancia's assessment methodologies, templates, and service offerings.
* Stay current on emerging threats, technologies, regulations, and security trends.

Qualifications and Experience

* Bachelor's degree in Information Security, Computer Science, Information Systems, or a related field, or equivalent professional experience.
* 10+ years of experience in information security, including at least 5 years in a leadership, CISO, vCISO, or senior advisory role.
* Proven experience leading TRAs, enterprise risk assessments, and maturity assessments, and delivering formal reports to executive audiences.
* Strong knowledge of risk management frameworks and methodologies, such as NIST SP 800-30, NIST RMF, ISO/IEC 27005, ISO 31000, and the Harmonized TRA Methodology (CSE/RCMP).
* Strong knowledge of security frameworks and standards, such as NIST CSF 2.0, ISO/IEC 27001/27002, CIS Controls, PCI DSS, HIPAA, and SOC 2.
* Experience building and running security programs, including governance, policy, incident response, and security metrics.
* Practical knowledge of cloud security, network security, identity and access management, and endpoint protection.
* Excellent written and verbal communication skills, including presenting risk to boards and executives in business terms.
* Strong analytical and problem-solving skills, with the ability to work independently and as part of a team.

Working Hours

8:00 AM – 5:00 PM Eastern Time (ET), Monday to Friday.

Compensation

Market-competitive compensation based on experience, qualifications, and expertise.