Managing Consultant - Cybersecurity

About Oblira

Oblira is an AI-native RegTech company that makes regulatory compliance continuous, automated and audit-ready instead of an annual scramble. One platform covers four modules: cybersecurity compliance (NIS2, DORA, EU AI Act, ISO 27001), supply chain due diligence (CSDDD, EUDR, forced labour, conflict minerals), sustainability reporting (CSRD, ESRS, GRI, ISSB) and ESG risk assessment for banks (EBA/GL 2025, Pillar 3, EU Taxonomy, SFDR).

We're not starting from scratch. Oblira was founded by senior advisory practitioners who spent years implementing these frameworks by hand for banks and corporates, and our senior team brings delivery experience across the EU, UK, US and Middle East. Every module is designed by someone who has delivered it manually for a client. Now we're turning that expertise into software.

The momentum is real. We're backed by strategic investors, partnered with leading international consulting firms, and working with major enterprise clients across financial services, energy, retail, telecoms and manufacturing, including market leaders serving millions of customers and ECB-regulated financial institutions. Clients and partners are signed across Western Europe, and our Middle East expansion is coming up next.

Our team currently works in two divisions. Platform Development & Integration builds the product and connects it into client environments. Consulting works directly with clients on regulatory and cybersecurity advisory engagements, and this is where we're hiring. As we scale up platform integration, we plan to bring our consultants into that work as well, so you'll build hands-on advisory experience now and grow into implementing the platform with clients as the company grows.

We're a Sofia-based startup with a senior team and a huge market ahead of us. We're looking for people ready to take real ownership from day one, not waiting for their turn on a fifteen-layer org chart. If you want your work to matter and to grow as fast as the company does, we'd love to meet you.

The Role

• Lead client engagements end-to-end across strategy, governance and risk advisory - target operating model design, capability and maturity assessment vs NIST CSF/ISO 27001, and multi-year transformation roadmaps sequenced by risk.

• Own the technical relationship with client security and IT leadership, acting as the senior expert on NIS2, DORA, GDPR, ISO/IEC 27001, and related frameworks.

• Lead regulatory readiness and assurance workstreams - gap analysis with costed remediation plans, control testing, certification preparation, and evidence packs for auditors, supervisors and the board

• Design target-state security architectures and governance models - policy and control frameworks, control mapping across regulations, and embedding controls into BAU ownership

• Support and manage complex, multi-year security transformation programmes, embedding cybersecurity into broader client transformation agendas

• Guide clients through the practical rollout of technical and organizational controls, drawing on the platform's technical domains - network security, endpoint and identity, IAM/IGA - to keep recommendations grounded in real implementation

• Act as vCISO or retained security advisor where engagements call for it - board reporting, risk appetite setting, and interim security leadership

• Support third-party and ICT supply chain risk work, including M&A cyber due diligence and post-acquisition control alignment

• Mentor and technically develop junior and senior consultants on the team, reviewing their assessments and client deliverables

• Build and maintain key client and partner relationships, support business development, and play an active role in winning new engagements

• Feed direct client insight back to the product team to help shape the platform roadmap

Education Requirements

• Bachelor's or Master's degree in Information Security, Computer Science, Information Systems, or a related discipline is preferred

• Certifications such as CISSP, CISM, CEH, OSCP, ISO 27001 Lead Auditor/Implementer, or equivalent are considered a strong plus

Experience Requirements

• Minimum 5 years of hands-on experience as an information security consultant, cybersecurity expert, or similar technical security role, with a proven track record leading client engagements

• Deep knowledge of cybersecurity frameworks and regulation such as NIS2, DORA, GDPR, ISO/IEC 27001, NIST CSF/800-53, and PCI-DSS

• Strong background understanding across security domains - risk management, network and infrastructure security, identity and access management (IAM/IGA), incident response, and vendor/third-party risk

• Track record designing and implementing enterprise-level security controls, governance structures and target operating models, not just assessing them on paper

• Experience leading regulatory readiness, certification (e.g. ISO 27001, PCI-DSS), or supervisory/audit-facing engagements is a strong plus

• Demonstrated relationship-building and business development skills - the ability to identify and close new opportunities

• Experience managing and technically mentoring consulting teams

• Excellent written and verbal communication skills - the ability to turn complex technical and regulatory topics into clear messages for leadership teams

• Fluency in English; an additional language is considered a plus

What We Offer

• A leadership role in a fast-growing, well-funded AI startup with a real product and real multinational clients

• Direct influence over the company's product and business strategy

• Exposure to some of the most current regulatory topics in Europe (NIS2, DORA, CSRD, EU AI Act), working with leading organizations across the region

• Competitive compensation and fast-track professional growth

• A dynamic and friendly working environment