About the Role
DigiSôter is a specialised cybersecurity consultancy that helps organisations achieve and maintain compliance with EU cybersecurity regulations. As the Cyber Resilience Act (Regulation 2024/2847) reshapes how manufacturers, importers, and distributors bring connected products to the EU market, our clients need expert guidance to transform their product development, documentation, and lifecycle management practices before the December 2027 full compliance deadline and the September 2026 vulnerability reporting obligations. We are seeking a freelance Senior Security Consultant to join our team of CRA specialists on a project basis. You will be deployed to DigiSôter client engagements as the trusted advisor helping product-centric organisations navigate this regulation. Working directly alongside engineering, development, and product management teams, you will build security into the fabric of their connected products. This is not a back-office compliance exercise: you will operate at the intersection of product strategy, software engineering, and cybersecurity regulation, representing DigiSôter's expertise and methodology.
Key Responsibilities
CRA Compliance Strategy & Roadmap
- Conduct gap analyses against the essential cybersecurity requirements outlined in Annex I of the CRA, covering both security properties and vulnerability handling obligations.
- Develop tailored compliance roadmaps aligned with product release cycles, accounting for the September 2026 reporting deadline and the December 2027 full compliance milestone.
- Classify client products against the CRA's Important (Annex III) and Critical (Annex IV) product categories and determine applicable conformity assessment routes (self-assessment, third-party, or EU-type examination).
- Advise on the regulatory obligations specific to each role in the supply chain: manufacturer, importer, and distributor.
Secure Product Development
- Work hand-in-hand with engineering and development teams to embed secure-by-design and secure-by-default principles throughout the software development lifecycle (SDLC).
- Guide teams in conducting threat modelling sessions for connected products, identifying attack surfaces, and defining proportionate security controls.
- Support the implementation of secure coding practices, code review procedures, and automated security testing integration within CI/CD pipelines.
- Advise on encryption, authentication, access control, and data protection mechanisms appropriate to each product's risk profile.
Vulnerability Management & Incident Reporting
- Design and operationalise vulnerability handling processes that meet the CRA's Annex I, Section 2 requirements, including coordinated vulnerability disclosure (CVD) policies.
- Establish workflows for tracking, triaging, and remediating vulnerabilities throughout the product's entire support period.
- Prepare clients for the mandatory reporting obligation to ENISA (via the single reporting platform) within 24 hours for actively exploited vulnerabilities.
- Support the setup of Product Security Incident Response Teams (PSIRTs) where needed.
SBOM & Supply Chain Transparency
- Guide product teams in generating, maintaining, and managing Software Bills of Materials (SBOMs) in machine-readable formats (CycloneDX, SPDX).
- Assess the cybersecurity posture of third-party and open-source components integrated into client products.
- Advise on due diligence processes for software supply chain risk management, including continuous monitoring of upstream dependencies.
Technical Documentation & Conformity Assessment
- Oversee the preparation of technical documentation required under Article 31, including risk assessments, design specifications, test results, and security update policies.
- Support the drafting of EU Declarations of Conformity and the preparation of CE marking files.
- Liaise with Notified Bodies where third-party conformity assessment is required (Important Class II and Critical products).
- Ensure documentation meets the 10-year retention obligation imposed by the regulation.
Stakeholder Engagement & Knowledge Transfer
- Act as the primary CRA subject matter expert for client engagements, translating regulatory language into actionable technical requirements for engineering, development, and product management stakeholders.
- Deliver workshops, awareness sessions, and training programmes tailored to technical audiences (developers, architects, product owners).
- Produce executive-level briefings for C-suite and board-level reporting on CRA compliance status and residual risk.
- Contribute to DigiSôter's internal knowledge base, thought leadership publications, and CRA advisory methodology.