Cybersecurity Consultant

Xebia is a global AI-first, digital transformation, and engineering partner. With over 25 years of experience and a team of 5,000 professionals across 16 countries, we help organizations design and build scalable products, platforms, and data-driven solutions. 

We specialize in Artificial Intelligence, Data and Cloud, Intelligent Automation, and Digital Products, combining deep technical expertise with a strong focus on engineering excellence and a people-first culture.  

In the CEE region, we’re a team of nearly 1,000 experts delivering modern applications, data platforms, and AI solutions for clients such as McLaren, Aviva, Deloitte, Spotify, Disney, ING, UPS, Tesco, Truecaller, AllSaints, Volotea, Schmitz Cargobull, Allegro, InPost, and many, many more. We work with leading technologies including AWS, Azure, GCP, Databricks, and Snowflake, and combine strong engineering culture with a consulting mindset and a continuous focus on growth and knowledge sharing. 

About project:

We are looking for an Information Security Consultant to join an engagement with our international client, who is strengthening its information security across engineering, IT, and compliance functions.

The project focuses on improving security visibility and control across the organization, including establishing a complete inventory of APIs and endpoints, implementing an access matrix for users and applications, strengthening identity and access management, and closing gaps in vulnerability management and CI/CD security.

Reporting to the IT Security Manager, you will take a hands-on, delivery-focused approach to implementing security controls, documenting processes, and supporting knowledge transfer. You will work closely with multiple technical teams and stakeholders, with a high degree of autonomy in technical decision-making.

You will be:

• hardening CI/CD pipelines by enforcing least-privilege access, isolating build environments, and managing pipeline configurations as code,
• integrating and tuning security gates for SAST, SCA, dependency scanning, secret detection, container images, and infrastructure-as-code,
• implementing secure secrets management, credential rotation, and appropriate segregation of CI/CD credentials,
• strengthening software supply-chain security through artifact signing, SBOM generation, dependency pinning, and trusted registries,
• enforcing source-control and release security controls, including branch protection, mandatory reviews, and protected release workflows,
• building and maintaining an authoritative inventory of APIs, endpoints, and supporting infrastructure, including ownership, classification, exposure, and lifecycle status,