Security & Safety|Security|Security Consultant,Security & Safety|Security,Security & Safety,Consulting Jobs

Client: large hospital system in Philadelphia
Location: hybrid- based in University City Philadelphia
Duration: 1 year + extensions

Job Summary:

• Demonstrates specialized & comprehensive knowledge in Information security management practices, disciplines, regulations, industry standards, related frameworks, project management principles, and methodologies, security engineering concepts, security operations model; industry standards around architecture principles.
• Demonstrates exceptional skills in managing multiple projects and priorities in order to meet strategic goals and timelines.
• Exhibits the ability to plan, manage and implement highly complex enterprise architecture and security implementations, enhancements or modifications that require in-depth knowledge across multiple technical areas and business segments.
• Exhibits exceptional understanding of emerging regulatory and healthcare issues in order to develop internal and external checks and controls to ensure proper governance, security and quality of information assets.
• Demonstrates exceptional troubleshooting and collaborative skills required to identify, analyze and resolve complicated security issues.
• Demonstrates advanced proficiency in creating detailed documentation, perform budget planning and oversight, and providing input on the infrastructure strategic planning, technology standards, and information security and risk practices.
• Exhibits ability to communicate effectively with clients, colleagues, vendors, management and the ability to translate complex technical solutions into non-technical requirements documents.
• Performs planning, development, implementation, and delivery of enterprise architecture and engineering principles for new, existing and future strategic and operational activities.
• Demonstrates the ability to provide technical expertise and consultation to the CIO, CTO, CISO, executive leadership and other business and clinical leaders.

Job Functions:

• A Principal Information Security Specialist has similar responsibilities to Information Security Specialist III personnel. However, a Principal Information Security Specialist is deemed to be the subject matter expert and in-house advisor on complex problems and issues.
• Works independently to initiate assignments and draws upon extensive professional knowledge and experience to make independent judgments regarding analysis, evaluation, development, and implementation of enterprise long-term solutions and operating initiatives to ensure that enterprise architectural objectives are aligned with organizational needs and strategic goals.
• Optimizes information management approaches through an understanding of evolving business needs and technology capabilities and ensures that projects do not duplicate functionality or diverge from each other and business and IT strategies.
• Shapes, designs, and plans specific service lines in product area and manages the risks associated with information and IT assets through appropriate standards and security policies.
• Functions as the Subject Matter Expert (SME) to maintain an understanding of the IS business and clinical applications and the relationship to InfoSec and compliance solutions; assist Hospital stakeholders in understanding information protection needs that support the Hospital's business.
• Works with other architects to provide a consensus based enterprise solution that is scalable, adaptable and in synchronization with ever changing business needs and takes ownership of a particular solution offering.
• Works with highly matrixed team of IS personnel to support enterprise architecture and information security operations including, but not limited to, architecture and InfoSec principles around identity & access management models, cloud identify management providers, security information and event monitoring, and data loss prevention, perimeter (e.g. firewalls, IPS, web filtering), cloud and virtualization environments and network security (host-based firewalls, anti-virus, disk encryption).
• Support and/or lead activities around InfoSec standards for business continuity and change management activities (e.g., table tops and change review board) and educates IS Hospital management on security issues (e.g., Identity and Access Management (IAM), Role Based Access Control (RBAC) models.

Skills:

• Demonstrates comprehensive knowledge and understanding of Information security principles, general and IT controls (e.g., access controls, risk management, change management, cloud security) and related information security policies and procedures.
• Exhibits knowledge of industry regulatory standards and accreditation requirements or control frameworks (HIPAA, PCI, Joint Commission, NIST, Red Flags, ISO 27000 series).
• Comprehensive knowledge of information security regulations, standards and leading practices, including understanding of EHR, cloud frameworks, identity access controls.
• Good knowledge of basic database query techniques & data mining to analyze data or other related database functionality.
• Knowledge of Microsoft Active Directory, UNIX, and Clinical Applications a plus.
• Experience implementing application level security in clinical and financial systems (e.g., Epic, Lawson). ERP experience a plus.
• General understanding of networking and communication techniques including WANs, LANs, Internet, Intranet, protocols, such as TCP/IP and their impact on security.
• Microsoft, UNIX, Lawson, and Clinical Applications,
• Experience with industry standard SDLC methodologies; hands-on experience in Project Server methodologies, PMO project management skills, including use of MS productivity tools (Access, Word, PowerPoint, Visio, Project).
• Experience with risk management frameworks.

Information Security Requirements:

• Understand and comply with all enterprise and IS departmental information security policies, procedures and standards.
• Support the integration of information security in the development, design, and implementation of Hospital Technology Resources that process, transmit, or store company information.
• Support all compliance activities related to state, federal regulatory requirements, healthcare accreditation standards, and all other applicable regulations that govern the use and disclosure of patient, financial, or other confidential information.

Education:
Required:

• Bachelor's Degree

Preferred:

• Bachelor's Degree in Computer Science, Information Systems, or related field

Required Experience:

• At least twelve (12) years industry related experience, including experience in one to two IT disciplines (such as technical architecture, network management, application development, middleware, information analysis, database management or operations) in a multitier environment.
• At least six (6) years experience with information security, regulatory compliance and risk management concepts.
• At least three (3) years experience with Identity and Access Management, user provisioning, Role Based Access Control, or control self-assessment methodologies and security awareness training.
• Experience with Cloud and/or Virtualization technologies.

Preferred Experience:

• At least three (3) years in working with matrixed high performance teams.

Position: Offensive Security Consultant / Penetration Tester
Location: United States - Remote
Employment Type: Full Time
TalentFish is casting a line for experienced Penetration Testers. Our client is an established consulting firm focused on Cyber, Risk and Penetration testing. This role is open due to company growth and requires consultative Penetration testers. This is a not tool-heavy checkbox testing organization. We are fishing for Penetration testers who think like adversaries, pursue meaningful attack paths, and turn technical evidence into decisions clients can act on. We are looking for a consultant first mentality - testers who are focused on actual remediation and client solutions.
You are an experienced penetration tester who prefers deep manual work over scanner-driven checklists. You enjoy chaining findings, building proof-of-concept tooling, thinking like an adversary, and explaining technical risk clearly. You understand that the test isn't finished when the exploit lands, it's finished when the client understands their risk and knows how to fix it.
The person we're looking for: You combine technical depth with humility, curiosity, clear communication, strong judgment, and a bias toward practical solutions.
What You'll Do

• Lead manual penetration tests across network, web/API, cloud, wireless, thick client, and enterprise environments
• Execute objective-based red team and adversary simulation engagements when in scope
• Develop custom proof-of-concept exploits, scripts, and tradecraft when existing tools are not enough
• Produce clear reports with attack narratives, evidence, business impact, and prioritized remediation guidance
• Contribute to methodology, tooling, lab work, research, and deliverables.
• Participate in project kickoff and report delivery meetings
• Mentor by example through sound judgment, clean execution, and professional communication
• Support clients through remediation: answer follow-up questions, validate fixes, and help their teams understand not just what was found, but why it matters

What You Bring

• 5+ years of hands-on experience in penetration testing, offensive security consulting, or red team operations
• Depth in at least one major domain, such as network, Active Directory, web/API, cloud, or red teaming
• A skills-based certification or equivalent practical proof of ability
• Proficient with common industry tools and C2 frameworks
• Scripting or coding ability useful for automation, tooling, or exploitation
• Working knowledge of PTES, OWASP, MITRE Telecommunication&CK, and related offensive security references
• Strong client-facing communication and ability to deliver with minimal supervision. You can walk a systems administrator through a finding, brief an executive on business risk, and listen well enough to understand a client's environment and constraints before prescribing fixes

Bonus Points

• Previous experience conducting penetration testing in a consulting capacity
• Experience testing cloud, identity, EDR-protected endpoints, or mature enterprise networks
• Ability to translate offensive security findings into compliance-relevant risk and remediation guidance
• Experience with malware development, C2 framework enhancements, and EDR evasion
• Desire to contribute to blog and/or speak at industry conferences on occasion

What you can expect: remote-first work, challenging client environments, uncapped quarterly performance bonus potential, paid training and certifications, conference opportunities, experienced teammates, and room to improve methodology.
Our client works as a high-trust, low-ego team that shares techniques, debriefs hard findings, challenges assumptions, and helps each other improve.
You will have room to go deep technically, improve methodology, contribute to research and tooling, and deliver work clients can rely on.

• US citizens and Green Card holders, EAD and TN are encouraged to apply. H1b sponsorship is not available for this role

Compenstation 130K to 150K + + base plus bonus.

------------------------------------------------------------------------------------------------------------------------------------------------

All offers are contingent upon the completion of a background check, which may include but is not limited to reference checks, education verification, employment verification, drug testing, criminal records checks, and any required certifications or compliance requirements based on the end client's background check policies and applicable laws.

TalentFish is an employee-owned company pioneering a new realm in talent acquisition. We are redefining IT staffing by evolving AI, video screening, and our unique platform. TalentFish focuses on providing the best employee, consultant, and client experience possible.
At TalentFish we are an Equal Opportunity Employer; we embrace and encourage diversity!

Application Security Consultant –

Must Have Responsibilities

• Lead application security design across web, mobile, and AWS cloud-native systems, including secure architecture reviews and CI/CD security integration.
• Administer and optimize SAST/SCA tools (e.g., Checkmarx, Snyk), triage vulnerabilities, and guide remediation aligned to OWASP Top Ten.
• Secure cloud environments (especially AWS Lambda, API Gateway, IAM, S3) and support runtime and application-layer protections.
• Partner with release and change management to ensure secure, stable production deployments and support go-live readiness.
• Provide security input in architecture and project planning, ensuring requirements are embedded early in design and development.
• Track vulnerabilities, produce reporting, and manage remediation progress across engineering teams.

Must Have Qualifications

• 3+ years in application security (offense and defense) with hands-on SAST/SCA experience.
• Strong knowledge of OWASP Top Ten and web/API security vulnerabilities and remediation.
• Experience securing AWS cloud services and working with cloud security platforms (e.g., Wiz, Prisma Cloud, Orca).
• Ability to read and review code in Java, JavaScript/Node.js, or Python for security validation.
• Experience with CI/CD pipelines, DevSecOps practices, and secure SDLC integration.
• Strong communication skills with ability to influence technical and business stakeholders.
• Experience working with change/release management in production environments.

Nice to Have Responsibilities

• Automate security testing and improve security tooling workflows.
• Develop and improve security runbooks, documentation, and operational procedures.
• Support penetration testing, secure code reviews, or developer training as needed.
• Participate in additional architecture discussions or advisory meetings when required.

Nice to Have Qualifications

• Familiarity with threat intelligence and how it informs application security controls.
• Experience driving developer security adoption through workshops or working sessions.
• Strong understanding of agile delivery environments and enterprise release governance.

Job Title: Business Information Security consultant
Location: Raritan, NJ 08869
Mode : Contract (6+ Months) - Onsite (Hybrid)


Position Description:
Provide Business Information Security consulting services in support of the development and deployment of a global Innovative Medicine CRM program, built using Salesforce Life Sciences cloud.
Activities include, but are not limited to:

• Providing support to the project team to ensure the application is developed and built following secure by design concepts adhering to the ISRM minimum viable security controls.
• Assist with defining remediation activities when necessary.
• Coordination with other ISRM capabilities such as Third-Party Risk Management, Data Security, and Security Architecture to ensure a unified approach to managing risks.
• Collaboration with the Policy, Governance, & Compliance function to align security controls with regulatory requirements and enterprise Clientls.
• Support application/tool assessment/issue remediation - including but not limited to reviewing AI capabilities

Must be skilled in providing expert guidance to promote adherence to security standards and best practices. Effective communication of cybersecurity risks to leadership/project team and alignment of security measures with business strategies

Position: Offensive Security Consultant / Penetration Tester
Location: United States - Remote
Employment Type: Full Time
TalentFish is casting a line for experienced Penetration Testers. Our client is an established consulting firm focused on Cyber, Risk and Penetration testing. This role is open due to company growth and requires consultative Penetration testers. This is a not tool-heavy checkbox testing organization. We are fishing for Penetration testers who think like adversaries, pursue meaningful attack paths, and turn technical evidence into decisions clients can act on. We are looking for a consultant first mentality - testers who are focused on actual remediation and client solutions.
You are an experienced penetration tester who prefers deep manual work over scanner-driven checklists. You enjoy chaining findings, building proof-of-concept tooling, thinking like an adversary, and explaining technical risk clearly. You understand that the test isn't finished when the exploit lands, it's finished when the client understands their risk and knows how to fix it.
The person we're looking for: You combine technical depth with humility, curiosity, clear communication, strong judgment, and a bias toward practical solutions.
What You'll Do

• Lead manual penetration tests across network, web/API, cloud, wireless, thick client, and enterprise environments
• Execute objective-based red team and adversary simulation engagements when in scope
• Develop custom proof-of-concept exploits, scripts, and tradecraft when existing tools are not enough
• Produce clear reports with attack narratives, evidence, business impact, and prioritized remediation guidance
• Contribute to methodology, tooling, lab work, research, and deliverables.
• Participate in project kickoff and report delivery meetings
• Mentor by example through sound judgment, clean execution, and professional communication
• Support clients through remediation: answer follow-up questions, validate fixes, and help their teams understand not just what was found, but why it matters

What You Bring

• 5+ years of hands-on experience in penetration testing, offensive security consulting, or red team operations
• Depth in at least one major domain, such as network, Active Directory, web/API, cloud, or red teaming
• A skills-based certification or equivalent practical proof of ability
• Proficient with common industry tools and C2 frameworks
• Scripting or coding ability useful for automation, tooling, or exploitation
• Working knowledge of PTES, OWASP, MITRE Telecommunication&CK, and related offensive security references
• Strong client-facing communication and ability to deliver with minimal supervision. You can walk a systems administrator through a finding, brief an executive on business risk, and listen well enough to understand a client's environment and constraints before prescribing fixes

Bonus Points

• Previous experience conducting penetration testing in a consulting capacity
• Experience testing cloud, identity, EDR-protected endpoints, or mature enterprise networks
• Ability to translate offensive security findings into compliance-relevant risk and remediation guidance
• Experience with malware development, C2 framework enhancements, and EDR evasion
• Desire to contribute to blog and/or speak at industry conferences on occasion

What you can expect: remote-first work, challenging client environments, uncapped quarterly performance bonus potential, paid training and certifications, conference opportunities, experienced teammates, and room to improve methodology.
Our client works as a high-trust, low-ego team that shares techniques, debriefs hard findings, challenges assumptions, and helps each other improve.
You will have room to go deep technically, improve methodology, contribute to research and tooling, and deliver work clients can rely on.

• US citizens and Green Card holders, EAD and TN are encouraged to apply. H1b sponsorship is not available for this role

Compenstation 130K to 150K + + base plus bonus.

------------------------------------------------------------------------------------------------------------------------------------------------

All offers are contingent upon the completion of a background check, which may include but is not limited to reference checks, education verification, employment verification, drug testing, criminal records checks, and any required certifications or compliance requirements based on the end client's background check policies and applicable laws.

TalentFish is an employee-owned company pioneering a new realm in talent acquisition. We are redefining IT staffing by evolving AI, video screening, and our unique platform. TalentFish focuses on providing the best employee, consultant, and client experience possible.
At TalentFish we are an Equal Opportunity Employer; we embrace and encourage diversity!