CISO / Cybersecurity Advisor for Internal Security Oversight

Job Description

Company: Upwork

We are looking for an experienced CISO / cybersecurity advisor to support our company’s internal security governance, risk management, compliance, and technical security oversight.

The role is not purely strategic. We need someone who can actively review security risks, guide remediation, work with R&D/IT teams, and help us maintain a practical security program.

Key Responsibilities

The CISO will be expected to:

Review and assess cybersecurity risks across infrastructure, cloud, SaaS tools, internal systems, and development workflows.

Review every new Software/SaaS tool the company wants to use before approval, including security posture, data access, privacy, compliance, authentication, and vendor risk.

Monitor vulnerability findings from tools such as Snyk, assess severity, and open or coordinate tickets with the R&D team for remediation.

Track remediation of critical and high-risk vulnerabilities until closure.

Support and guide ISO 27001 / ISMS compliance, including policies, controls, evidence, risk register, audit readiness, and ongoing security governance.

Review access management, privileged accounts, IAM users, password management, key rotation, and admin permissions.

Provide security guidance for AI tools, automation platforms, cloud services, and third-party integrations.

Support incident response, credential exposure reviews, and security investigations.

Help prepare security summaries, customer security responses, and executive-level risk updates.

Run or support employee security awareness activities, including phishing awareness and security communications.

Ideal Candidate

We are looking for someone with strong experience in:

Acting as CISO, virtual CISO, security lead, or senior security consultant.

ISO 27001 implementation or ongoing compliance support.

Vulnerability management and secure SDLC.

SaaS/vendor security reviews.

Cloud and IAM security.

Working directly with R&D, IT, management, and compliance stakeholders.

Translating security findings into practical tickets, actions, and priorities.

Expected Output

The engagement should result in clear security recommendations, tracked remediation items, documented risks, ISO 27001 support, SaaS/security reviews, and practical guidance that helps the company improve its security posture without slowing down operations unnecessarily.

Source: Upwork