Fractional CISO Security Assessment Roadmap

Fractional CISO / Senior Cybersecurity Consultant | Initial 9-Hour Engagement

We are seeking a highly experienced and certified senior cybersecurity professional / fractional CISO for an initial 9-hour consulting engagement, with the possibility of ongoing work.

This role is not limited to Microsoft Sentinel. We require someone capable of reviewing cybersecurity from both a CISO/governance perspective and a hands-on technical perspective.

The objective is to assess the current security environment, identify critical risks and gaps, review existing security controls, improve monitoring and response capabilities, and establish a practical cybersecurity roadmap.

Scope of Work

The selected consultant will be expected to review areas including:

Overall cybersecurity posture and architecture
Security governance and risk management
Identity and access management
Microsoft 365 / Entra ID security
Endpoint security and EDR/XDR
Microsoft Defender XDR
Microsoft Sentinel / SIEM
Firewall and network security
Vulnerability management
Email and collaboration security
Data protection and DLP
Backup, recovery and ransomware readiness
Privileged access
Incident response procedures
Security monitoring and SOC processes
Threat detection and threat hunting
Security policies and procedures
Business continuity and disaster recovery
Third-party/vendor security risks
Security awareness requirements
Compliance readiness where applicable
Mandatory Deliverables

The 9 hours must result in actual deliverables, not only meetings or verbal consultation.

The consultant will be required to provide:

Executive cybersecurity assessment
Technical security assessment
Identified vulnerabilities, risks and gaps
Risk classification by Critical / High / Medium / Low
Immediate remediation priorities
Review of security monitoring and incident response
Microsoft Sentinel/Defender recommendations where applicable
Security architecture recommendations
Required security policies/procedures
Recommended cybersecurity tools or control improvements
30/60/90-day cybersecurity roadmap
Technical and management handover report
Required Experience / Certifications

Candidates should have strong senior-level cybersecurity experience.

Preference will be given to candidates holding one or more recognized certifications such as:

CISSP
CISM
CCISO
CRISC
CISA
ISO/IEC 27001 Lead Implementer / Lead Auditor
Microsoft cybersecurity certifications such as SC-100 / SC-200

A certification alone is not sufficient. The candidate must demonstrate practical experience in cybersecurity architecture, risk, incident response, Microsoft security technologies and security operations.

Confidentiality & Security Obligations

The selected consultant must:

Maintain strict confidentiality regarding all information accessed during the engagement.
Sign an NDA if requested.
Work strictly within specifically authorized systems and permissions.
Never attempt to access systems or information outside the approved scope.
Never copy, download, retain or disclose confidential information without authorization.
Never make destructive or high-impact security changes without written approval.
Obtain approval before implementing automated blocking, account disabling, endpoint isolation or other potentially disruptive actions.
Document all significant changes and recommendations.
Immediately report any critical vulnerability, suspected compromise or active security incident discovered.
Provide full handover of documentation, configurations, scripts, queries and other work produced during the engagement.
Delete locally retained confidential information after completion of the assignment.
Who We Are Looking For

We are not looking for:

General IT support
Someone who only runs vulnerability scanners
Someone focused exclusively on Microsoft Sentinel
A consultant providing only templates or theoretical recommendations
Someone with CISO certification but no hands-on technical capability

We need a professional who can think like a CISO, assess risk like a security consultant, and understand the technical environment sufficiently to challenge and guide engineers.

Application Requirements

Please provide:

Years of cybersecurity experience
CISO/security leadership experience
Current cybersecurity certifications
Microsoft security experience
SIEM/SOC experience
Incident response experience
Risk and compliance experience
Examples of similar assessments completed
Your hourly rate
Availability for the initial 9-hour engagement

Please clearly state which cybersecurity certifications you currently hold and whether they are active.

Successful completion of the initial engagement may lead to ongoing fractional CISO / cybersecurity advisory work.

---
來源：Freelancer.com | 出價次數：12 | 剩餘時間：6 日 | 專案類型：按小時