Security Consultant

GVC is an Italian NGO founded in 1971. Actually is working in 22 countries worldwide. GVC presence in Lebanon dates back to the begin of Syrian Crisis and since then GVC has been implementing emergency and development projects in Bekaa and Akkar, financed by International Donors mainly in WASH sector.
 

WeWorld-GVC is developing a web application (CPA Platform) that centralizes data collected in the field and helps staff operationalize, analyze and report on this data.

The CPA platform is cloud based with interactions from tablets or user machines.

The platform is intended to be used only by field staff of WeWorld-GVC and select partners on a per-user basis.

The platform contains roles and permissions that allow different layers of data access depending on those roles.

Given the nature of the data hosted on the platform, WeWorld-GVC would like to hire a security consultant to review its application security, it’s efficiency, possible loopholes and to provide support in improving its current data and cyber-security posture and provide tools to help it maintain a high level of awareness of potential risks and mitigations as they emerge.

Responsibilities:

• Perform penetration testing and security audits of the CPA platform and it’s supporting servers and databases.
• Identify current and potential software and hardware risks and suggest mitigation.
• Identify possible risk scenarios, perform threat simulations, provide assessment of IM team response capabilities.
• Deliver security testing suite and training for the IM team on how to deploy and test for security vulnerabilities.
• Test and identify CPA platform permission system, identify possible vulnerabilities and suggest mitigation.
• Review IM & field staff operational data security and provide recommendations.

Qualifications:

• Bachelor’s degree in a technical field
• 2 to 5 years of comparable experience;
• Experience in consultancy engagements focused around the security industry, such as risk assessments, compliance audits and strategy advisory;
• Demonstrable expertise in client industry (E.g. public sector, financial services, energy and utilities) with focus on industry specific best practice, threats and regulations;
• One or more cyber/information security qualification (CISSP, CISM, CCSP or Equivalent);