Overview
Seeking an experienced Application Security / Product Security Consultant with strong Privacy Engineering / Privacy-by-Design experience.
The role will focus on application and data security, secure architecture, codebase reviews, vulnerability identification, and security best practices, acting as an independent second pair of eyes across the technology stack. The engagement is advisory and task-driven rather than a conventional full-time security operations role, with periodic reviews and additional support as security-related requirements arise.
The person must be capable of reviewing an existing web application/codebase and architecture from both security and privacy perspectives, with strong practical knowledge of GDPR technical controls. Privacy experience must be demonstrable in previous engineering/security projects; not just GDPR certification or compliance exposure.
Job Description
Key Responsibilities
- Conduct periodic security and codebase reviews across application architecture and development practices.
- Assess authentication, authorization, access controls, API security, data handling, and third-party integrations.
- Identify vulnerabilities, security gaps, attack surfaces, and potential failure scenarios.
- Review application architecture and recommend improvements for secure-by-design development.
- Assess data storage, transmission, retention, encryption, secrets management, and privacy controls.
- Support GDPR-oriented security and data protection practices, particularly around personally identifiable and sensitive user data.
- Review development practices and provide recommendations for maintaining a secure and maintainable codebase.
- Support vulnerability assessment, threat modelling, dependency/security scanning, and remediation planning.
- Work with developers to explain findings and recommend practical remediation approaches.
- Provide periodic security assessments and documentation covering identified risks, recommendations, and priority actions.
Skills & Requirements
- Privacy-by-Design / Data Protection by Design & Default
- Experience reviewing security for consumer-facing platforms or marketplaces
- Privacy controls implemented within applications and architectures
- GDPR technical implementation, not just compliance/policy
- Data minimization & purpose limitation
- Access controls / role-based access / authorization
- Consent and user privacy controls
- Personal data lifecycle management — collection, processing, storage, retention and deletion
- Data masking / pseudonymization / anonymization
- Encryption of personal/sensitive data — at rest & in transit
- Privacy-aware API and database design
- Data classification and sensitive-data handling
- Audit logging and traceability of access to personal data
- Third-party/vendor data-sharing controls
- Privacy impact / risk assessments (DPIA exposure is a strong plus)
- Secure code and architecture reviews
- OWASP / API Security / authentication & authorization
- Ability to look at an existing codebase and architecture and recommend concrete privacy + security improvements
Nice to Have:
- Experience with cloud security and modern application infrastructure
- Familiarity with CI/CD security and DevSecOps practices
- Experience with applications handling payments, identity verification, location data, or minors' data
- Relevant cybersecurity certifications such as CISSP, OSCP, CISM, Security+, or equivalent
Apply Now