Xebia is a global AI-first, digital transformation, and engineering partner. With over 25 years of experience and a team of 5,000 professionals across 16 countries, we help organizations design and build scalable products, platforms, and data-driven solutions.

We specialize in Artificial Intelligence, Data and Cloud, Intelligent Automation, and Digital Products, combining deep technical expertise with a strong focus on engineering excellence and a people-first culture.

In the CEE region, we’re a team of nearly 1,000 experts delivering modern applications, data platforms, and AI solutions for clients such as McLaren, Aviva, Deloitte, Spotify, Disney, ING, UPS, Tesco, Truecaller, AllSaints, Volotea, Schmitz Cargobull, Allegro, InPost, and many, many more. We work with leading technologies including AWS, Azure, GCP, Databricks, and Snowflake, and combine strong engineering culture with a consulting mindset and a continuous focus on growth and knowledge sharing.

About project:

We are looking for an Information Security Consultant to join an engagement with our international client, who is strengthening its information security across engineering, IT, and compliance functions.

The project focuses on improving security visibility and control across the organization, including establishing a complete inventory of APIs and endpoints, implementing an access matrix for users and applications, strengthening identity and access management, and closing gaps in vulnerability management and CI/CD security.

Reporting to the IT Security Manager, you will take a hands-on, delivery-focused approach to implementing security controls, documenting processes, and supporting knowledge transfer. You will work closely with multiple technical teams and stakeholders, with a high degree of autonomy in technical decision-making.

You will be:

hardening CI/CD pipelines by enforcing least-privilege access, isolating build environments, and managing pipeline configurations as code,
integrating and tuning security gates for SAST, SCA, dependency scanning, secret detection, container images, and infrastructure-as-code,
implementing secure secrets management, credential rotation, and appropriate segregation of CI/CD credentials,
strengthening software supply-chain security through artifact signing, SBOM generation, dependency pinning, and trusted registries,
enforcing source-control and release security controls, including branch protection, mandatory reviews, and protected release workflows,
building and maintaining an authoritative inventory of APIs, endpoints, and supporting infrastructure, including ownership, classification, exposure, and lifecycle status,
mapping assets against applicable security controls, including authentication, authorization, encryption, logging, monitoring, and rate limiting,
establishing processes for registering new assets and periodically reviewing inventory accuracy and coverage,
designing and documenting an access matrix for human users, service accounts, API clients, integrations, and automated jobs,
applying least-privilege and segregation-of-duties principles to access assignments and defining appropriate permission scopes for application-to-application access,
strengthening identity and access management, including enforcing Single Sign-On (SSO) wherever technically feasible,
onboarding identified assets and endpoints into Qualys, organizing assets by risk and validating scan coverage against the complete inventory,
coordinating vulnerability triage and remediation in line with severity thresholds, remediation SLAs, and reporting requirements,
documenting security controls, procedures, findings, and recommendations in English,
collaborating with engineering, IT, and compliance stakeholders to implement security improvements and support knowledge transfer.

Your profile:

proven experience in information security, IT security, or product security within complex technical environments,
hands-on experience with security asset management, including building and maintaining asset inventories,
practical experience with SAST and DAST and integrating security testing into software delivery workflows,
working knowledge of API security, including the OWASP API Security Top 10, authentication and authorization models, and encryption standards,
experience designing and documenting access control models, including RBAC and access matrices,
understanding of IAM principles, SSO, least-privilege access, and service-account security,
experience with vulnerability management processes, including asset onboarding, scan coverage, risk-based prioritization, and remediation tracking,
familiarity with information security and compliance frameworks such as ISO 27001, NIS2, or SOC 2,
strong technical documentation skills and the ability to translate security requirements into clear, actionable procedures,
strong communication skills and the ability to collaborate with both technical and business stakeholders,
a hands-on, delivery-oriented mindset, with the autonomy to drive tasks forward and solve problems proactively,
professional fluency in English, as all documentation and deliverables will be in English.

Practical experience using AI-powered assistants (e.g. Claude Code, GitHub Copilot, Cursor) to improve productivity, quality, or decision-making in software delivery.
Work from the European Union region and a work permit are required.

Nice to have:

familiarity with cloud environments, particularly AWS,
experience with GitHub and securing source-control and CI/CD workflows,
experience with vulnerability management platforms such as Qualys,
familiarity with identity providers and SSO platforms such as Okta or Microsoft Entra ID,
experience with software supply-chain security, including SBOMs, artifact signing, and dependency security,
experience working across multiple product and engineering teams in an international organization.
Location: Bucharest, Romania,
Work mode: Hybrid, with 3 days per week on-site,

Recruitment Process:

CV review – HR call – Interview – Client Interview – Decision