Senior Consultant - Cybersecurity

About Oblira

Oblira is an AI-native RegTech company that makes regulatory compliance continuous, automated and audit-ready instead of an annual scramble. One platform covers four modules: cybersecurity compliance (NIS2, DORA, EU AI Act, ISO 27001), supply chain due diligence (CSDDD, EUDR, forced labour, conflict minerals), sustainability reporting (CSRD, ESRS, GRI, ISSB) and ESG risk assessment for banks (EBA/GL 2025, Pillar 3, EU Taxonomy, SFDR).

We're not starting from scratch. Oblira was founded by senior advisory practitioners who spent years implementing these frameworks by hand for banks and corporates, and our senior team brings delivery experience across the EU, UK, US and Middle East. Every module is designed by someone who has delivered it manually for a client. Now we're turning that expertise into software.

The momentum is real. We're backed by strategic investors, partnered with leading international consulting firms, and working with major enterprise clients across financial services, energy, retail, telecoms and manufacturing, including market leaders serving millions of customers and ECB-regulated financial institutions. Clients and partners are signed across Western Europe, and our Middle East expansion is coming up next.

Our team currently works in two divisions. Platform Development & Integration builds the product and connects it into client environments. Consulting works directly with clients on regulatory and cybersecurity advisory engagements, and this is where we're hiring. As we scale up platform integration, we plan to bring our consultants into that work as well, so you'll build hands-on advisory experience now and grow into implementing the platform with clients as the company grows.

We're a Sofia-based startup with a senior team and a huge market ahead of us. We're looking for people ready to take real ownership from day one, not waiting for their turn on a fifteen-layer org chart. If you want your work to matter and to grow as fast as the company does, we'd love to meet you.

The Role

• Run current-state and maturity assessments against NIST CSF, ISO/IEC 27001, and related frameworks, and turn findings into a prioritized, risk-sequenced roadmap

• Support regulatory readiness workstreams across DORA (ICT risk framework, register of information, incident reporting), NIS2 (scope, governance duties, management accountability), and GDPR (controls, DPIAs, breach readiness)

• Perform gap analyses against specific obligations and produce costed remediation plans clients can actually execute

• Contribute to ISO 27001 gap assessments, ISMS design, and Statement of Applicability work, and support clients through stage 1/2 certification audits

• Author policies, standards, procedures, and control descriptions, and help embed controls into business-as-usual ownership rather than leaving them as documentation

• Support third-party and ICT supply chain risk work - supplier due diligence, criticality tiering, and contractual security requirements

• Help prepare clients for regulator, supervisor, and client security audits, including response drafting for findings, RFIs, and security questionnaires

• Draw on the platform's technical domains as engagements require - network security fundamentals, endpoint and identity controls - to give clients advice that reflects real implementation constraints, not just paper compliance

• Work closely with the product team to translate client needs and real-world security challenges into platform requirements

• Build trust with client stakeholders as a credible, technically grounded advisor

• Support the practice's senior leaders in responding to new client needs and business development

Education Requirements

• Bachelor's degree in Information Security, Computer Science, Information Systems, or a related discipline is preferred

• Certifications such as CISSP, CISM, CEH, ISO 27001 Lead Auditor/Implementer, OSCP, or equivalent are considered a plus

Experience Requirements

• 2–4 years of hands-on experience as an information security consultant, cybersecurity analyst, or similar technical security role

• Practical experience implementing or assessing security controls against frameworks such as NIS2, DORA, GDPR, ISO/IEC 27001, or the NIST CSF

• Solid understanding of core security domains: risk management, network and infrastructure security, identity and access management, incident response, and vendor/third-party risk

• Exposure to certification or regulatory-readiness work (e.g. ISO 27001 gap assessment and ISMS design, PCI-DSS scoping) is a plus

• Experience working directly with client technical and security teams to design and roll out security controls, not just document them

• Ability to communicate complex technical and regulatory topics clearly and simply, in writing and verbally

• Self-motivated, detail-oriented, and comfortable working in a fast-moving, high-growth environment

• Fluency in English; an additional language is considered a plus

What We Offer

• A role in a fast-growing, well-funded AI startup with a real product and real clients

• Direct visibility and influence over product strategy - your voice matters here

• Exposure to some of the most current regulatory topics in Europe (NIS2, DORA, ISO 27001, EU AI Act)

• Competitive compensation and fast-track professional growth

• A dynamic and friendly working environment