Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowFirst seen 2 hours ago

Principal Consultant, Cyber Security

STIGroup, Ltd.1 open role

Where
Remote
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowPrincipal Consultant, Cyber SecuritySTIGroup, Ltd. · Remote

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on STIGroup, Ltd.'s own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

8.2% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 1.8%1 day
  2. 3.8%3 days
  3. 8.2%7 days
  4. 15.2%14 days
  5. 34.2%30 days
This job: first seen 2 hours ago

The posting

About STIGroup

STIGroup (Secure Technology Integration Group) is a SOC 2 Type II certified MSSP and cyber advisory firm headquartered in Mahwah, NJ. Founded in 2000, we serve clients nationally, with a concentration in Metro NY/NJ, across managed security, GRC, and advisory services. Our work spans regulated industries including financial services, healthcare, life sciences, and critical infrastructure, and we operate as an embedded extension of our clients' teams.

Role summary

STIGroup is hiring a Principal Consultant who can operate credibly across hands-on technical assessment and framework-aligned GRC advisory. You will own engagements end to end across managed security, GRC, and advisory, working with CISOs and operators to mature their programs. In addition, this Principal Consultant will be expected to help expand existing client relationships by identifying follow-on opportunities, contributing to account growth, and serving as a trusted primary point of contact throughout the engagement lifecycle. This is a senior individual contributor role, not a people-management position.

What you will do

  • Serve as the primary trusted advisor for assigned accounts, building senior client relationships, shaping ongoing security strategy, and translating emerging needs into scoped follow-on work.
  • Maintain executive-level client relationships across the engagement lifecycle, align stakeholders on priorities, and proactively identify opportunities for additional advisory, GRC, and managed security support.
  • Lead end-to-end delivery of cyber security and GRC engagements: security assessments, control design, architecture review, gap analyses, roadmaps, and remediation plans.
  • Do the hands-on technical work: review client environments, read logs and packet captures, validate controls through active testing, and design across endpoint, network, identity, cloud, and perimeter security.
  • Run framework-aligned assessments against SOC 2, NIST CSF, NIST 800-53, ISO 27001, HIPAA, and CMMC as applicable, and turn findings into prioritized remediation plans.
  • Author policies, standards, and procedures, build risk registers and control libraries, and support third-party risk and audit-readiness work.
  • Advise on managed security operations (SIEM/MDR coverage, log sources, detection gaps, vulnerability management, IR readiness) and support active incident response when needed.
  • Brief executive and board audiences when the engagement calls for it, in language that connects technical findings to business impact.
  • Own account growth through trusted advisory work: spot follow-on consulting, GRC, and managed-service opportunities, partner with leadership to scope and close them, and treat expansion as a measure of engagement quality.
  • Produce clear client-facing deliverables (assessment reports, executive readouts, status updates) without heavy editorial oversight.

What you bring (required)

  • 10+ years of progressive cyber security experience, including 5+ in client-facing consulting or MSSP delivery with end-to-end engagement ownership.
  • Executive stakeholder management and consultative communication skills, with the ability to build credibility quickly with CISOs, IT leadership, and business stakeholders.
  • Experience identifying client needs, shaping solution scopes, and contributing to follow-on consulting or managed security opportunities in a way that aligns to client outcomes.
  • Strong commercial judgment, including the ability to balance delivery quality, client trust, and account growth.
  • Workshop facilitation and discovery skills, including leading client interviews, surfacing priorities, and translating ambiguous requirements into actionable plans.
  • Technical depth across several of: vulnerability management, SIEM/MDR/SOC operations, incident response, IAM/MFA/PAM, endpoint and network, cloud (AWS, Azure, M365), and security architecture.
  • Hands-on experience applying NIST CSF and NIST 800-53 to client assessments; working fluency with ISO 27001, SOC 2, HIPAA, and CIS Controls; you sequence remediation, not just identify gaps.
  • Track record owning multiple concurrent engagements as the primary delivery lead from scoping through closure.
  • Direct experience in at least one regulated vertical: healthcare, financial services, or critical infrastructure (transportation, utilities, energy).
  • Strong written and verbal communication; able to move between a technical SOC conversation and a board readout without losing either audience.
  • Autonomy: you manage your own engagement portfolio and exercise sound judgment under pressure.
  • Based in or commutable to the Metro New York area, with on-site client work across the region as needed.

Nice to have

  • Big 4 or tier-1 advisory experience (Deloitte, PwC, EY, KPMG) and/or boutique MSSP or cyber consulting experience.
  • CISSP, CISM, CISA, CRISC, or ISO 27001 Lead Auditor / Lead Implementer certifications.
  • Multi-year vCISO, fractional CISO, or executive-sponsor program advisory (board reporting, roadmap ownership) for regulated clients.
  • Hands-on familiarity with CrowdStrike, Microsoft Defender / Sentinel, Splunk, Qualys / Tenable, Palo Alto, Fortinet, Okta, ServiceNow / Jira.
  • Direct experience supporting transit or transportation clients (e.g., agencies the size of NJ Transit) is a strong plus.

Compensation and logistics

  • Employment type: W2, full time.
  • Location: Metro New York area; hybrid (remote with on-site client work). Travel up to 25%.
  • Compensation: $185,000 to $215,000 base, plus performance bonus, commensurate with experience and regulated-industry depth.
  • Reporting line: CISO
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against STIGroup, Ltd.'s own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on STIGroup, Ltd.'s form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    STIGroup, Ltd.'s answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.