Cybersecurity Specialist Needed

Cybersecurity Gap Assessment, Incident Response Plan, Policy Development & Security Implementation Scope Project Context The company is a small real estate organization with approximately eight endpoint devices and core business systems including Salesforce CRM and Twilio. The objective of this engagement is to assess the company’s current cybersecurity readiness, identify gaps and weaknesses, create a practical cybersecurity incident response plan, develop a cybersecurity policy, and recommend the appropriate tools and technologies needed to strengthen the company’s security posture. The assessment should be aligned to a practical small-business cybersecurity model using NIST Cybersecurity Framework 2.0 and CIS Controls Implementation Group 1. --- ## 1. Cybersecurity Gap Assessment Objective The cybersecurity specialist will review the information already collected and use it to determine the current level of cybersecurity maturity across the organization. The assessment should identify weaknesses in: * Endpoint device security * User access and password management * Salesforce CRM security * Twilio account security * Email security * Cloud storage and file-sharing practices * Network, router, Wi-Fi, and firewall protection * Backup and disaster recovery readiness * Employee cybersecurity awareness * Incident response readiness * Vendor and third-party risk * Data privacy and protection practices * Existing or missing cybersecurity policies The final output should clearly state where the company is exposed, how serious each weakness is, and what must be done to fix it. ## 2. Assessment Methodology The cybersecurity specialist should use the following process: ### Phase 1: Document and Data Review Review all information provided, including: * Device list * Business systems used * Salesforce setup information * Twilio setup information * Staff roles and system access * Existing policies, if any * Current antivirus or endpoint protection * Email/domain setup * Backup process * Network and Wi-Fi setup * Known incidents or past security issues * Vendor list * Data handled by the company, including client, property, financial, and contract information ### Phase 2: Interview and Validation Conduct short interviews with the business owner, admin users, and selected staff to confirm: * How staff access Salesforce and Twilio * Whether MFA is enabled * How passwords are managed * Whether devices are personal or company-owned * How client files and contracts are stored * How data is shared internally and externally * Who handles IT support * What happens if a device is lost, stolen, or infected * Whether backups are tested * Whether staff know how to report suspicious emails or incidents ### Phase 3: Technical Review Perform a non-invasive technical review of: * Endpoint protection status * Patch/update status * Device encryption * User account permissions * MFA configuration * Email security settings * Salesforce user roles and permissions * Twilio user access and API/token controls * Backup coverage * Router/firewall configuration * Wi-Fi security * Vulnerability exposure * Logging and monitoring capability ### Phase 4: Gap Analysis Compare the current state against a practical target state using NIST CSF 2.0 and CIS Controls IG1. Each finding should include: * Gap identified * Risk level: Low, Medium, High, or Critical * Business impact * Likelihood of exploitation * Recommended fix * Priority level * Responsible owner * Estimated effort * Recommended tool or technology, if needed --- ## 3. Required Deliverable 1: Cybersecurity Gap Assessment Report The specialist must prepare a formal report with the following sections: ### Executive Summary A plain-language summary of the company’s overall cybersecurity readiness, key weaknesses, and top priorities. ### Current State Assessment A breakdown of the company’s current cybersecurity posture across: * Governance * Asset management * Identity and access management * Endpoint security * Network security * Cloud and SaaS security * Data protection * Backup and recovery * Security awareness * Incident response * Vendor risk * Monitoring and detection ### Risk Register A table showing each risk, risk rating, affected system, business impact, and recommended remediation. ### Gap Matrix A simple maturity matrix showing: | Security Area | Current State | Target State | Gap | Priority | | ------------------- | ---------------------------------- | --------------------------- | ------------------------------ | -------- | | MFA | Partially enabled or not confirmed | MFA enforced for all users | Unauthorized access risk | High | | Endpoint Protection | Basic or unknown | Managed endpoint security | Malware/ransomware exposure | High | | Backup | Unknown or informal | Automated and tested backup | Data loss risk | High | | Incident Response | No documented plan | Approved response plan | Delayed response during breach | High | ### Key Weaknesses The report should highlight the top security weaknesses likely to create the greatest business risk. Examples may include: * No formal cybersecurity policy * No incident response plan * No centralized endpoint management * Weak or inconsistent MFA * Poor password practices * Lack of backup testing * No vulnerability scanning * Limited email security * No monitoring or alerting * Excessive access privileges in Salesforce or Twilio * No documented process for lost/stolen devices * No employee cybersecurity training --- 4. Required Deliverable 2: Cybersecurity Incident Response Plan The specialist must develop a cybersecurity incident response plan suitable for a small real estate company. The plan should cover: Incident Response Objectives * Detect security incidents quickly * Contain the impact * Protect client and company data * Restore business operations * Meet legal, contractual, and regulatory obligations * Learn from incidents and improve controls Incident Categories The plan should include response procedures for: * Phishing attack * Business email compromise * Lost or stolen laptop * Malware or ransomware * Unauthorized Salesforce access * Unauthorized Twilio access * Data breach or client information exposure * Compromised password * Insider misuse * Website or account compromise * Vendor-related incident Incident Response Roles Define roles such as: * Incident Response Lead * Business Owner / Managing Director * IT or Cybersecurity Specialist * Legal / Compliance Contact * Communications Contact * System Owner for Salesforce * System Owner for Twilio Incident Response Process The plan should follow this structure: 1. Preparation 2. Detection and analysis 3. Containment 4. Eradication 5. Recovery 6. Communication 7. Documentation 8. Lessons learned NIST’s incident response guidance emphasizes that Detect, Respond, and Recover help organizations discover, manage, contain, eradicate, and recover from cybersecurity incidents, while Govern, Identify, and Protect help prepare the organization before incidents happen. Escalation Matrix The plan should define what counts as: * Low severity incident * Medium severity incident * High severity incident * Critical incident Each level should state who must be notified and how quickly. Communication Templates The plan should include draft templates for: * Internal incident notification * Vendor notification * Client notification, if required * Law enforcement or regulator notification, if required * Post-incident executive summary 5. Required Deliverable 3: Cybersecurity Policy The specialist must create a cybersecurity policy that is practical for a small real estate company and easy for staff to follow. The policy should include: ### Acceptable Use Policy Rules for using company devices, systems, internet, email, CRM, and communication tools. ### Password and MFA Policy Requirements for strong passwords, password managers, and mandatory MFA on Salesforce, Twilio, email, and all critical systems. ### Device Security Policy Requirements for: * Antivirus/EDR * Device encryption * Screen lock * Software updates * Lost/stolen device reporting * Approved software * Personal device use, if allowed Email and Phishing Policy Rules for identifying, reporting, and avoiding phishing, suspicious attachments, fake invoices, and wire fraud attempts. Data Protection Policy Rules for handling client data, contracts, property documents, IDs, financial information, and confidential business records. Access Control Policy Requirements for least-privilege access, user onboarding, user offboarding, admin accounts, and quarterly access reviews. Backup and Recovery Policy Rules for automated backups, backup testing, retention, and recovery responsibilities. Vendor Security Policy Basic vendor due diligence for IT providers, cloud services, CRM providers, communication tools, and external consultants. Incident Reporting Policy Clear instructions for staff on how to report suspicious activity, lost devices, account compromise, or accidental data exposure. --- 6. Required Deliverable 4: Tools and Technology Recommendation Report Based on the gaps identified, the specialist must recommend the tools and technologies needed to bring the company to an acceptable security level. The recommendations must be linked directly to the findings from the gap assessment. No tool should be recommended without explaining what risk it solves. ### Recommended Tool Categories The specialist should assess whether the company needs: 1. Endpoint Detection and Response For malware, ransomware, device protection, and threat detection. 2. Multi-Factor Authentication For Salesforce, Twilio, email, cloud storage, and administrator accounts. 3. Password Manager For secure password storage, sharing, and password hygiene. 4. Mobile Device Management / Endpoint Management For enforcing updates, encryption, remote wipe, and device policies. 5. Email Security For phishing protection, spam filtering, malicious attachment blocking, and impersonation protection. 6. Backup and Disaster Recovery For protecting business files, CRM exports, contracts, and critical data. 7. Firewall / Secure Router For network protection, Wi-Fi segmentation, and secure internet access. 8. Vulnerability Scanning For identifying weaknesses on devices, network equipment, and exposed services. 9. Logging and Monitoring For detecting suspicious logins, failed login attempts, unusual Salesforce activity, and Twilio account misuse. 10. Security Awareness Training For staff training on phishing, password safety, client data handling, and incident reporting. 11. Data Loss Prevention If the company handles sensitive client documents and needs stronger controls over file sharing. 12. Cybersecurity Support / MDR If the company does not have internal IT or cybersecurity staff, a managed security provider may be needed for monitoring and response. --- ## 7. Suggested Security Stack for a Small Real Estate Company The final recommendation should be cost-conscious and practical. For a company with eight endpoint devices, the recommended baseline stack may include: * Endpoint protection/EDR for all laptops and desktops * MFA on all business systems * Password manager for all staff * Microsoft 365 Business Premium or equivalent, if the company uses Microsoft email and documents * Device encryption and remote wipe * Business-grade firewall or secure router * Secure Wi-Fi with guest network separation * Cloud backup solution * Email security and anti-phishing controls * Quarterly vulnerability scans * Annual cybersecurity awareness training * Incident response retainer or managed cybersecurity support * Quarterly access review for Salesforce, Twilio, email, and file storage --- ## 8. Implementation Roadmap The cybersecurity specialist should create a phased roadmap. ### First 30 Days: Critical Controls * Enable MFA across all key systems * Install endpoint protection on all devices * Confirm backup coverage * Remove unnecessary admin access * Secure Salesforce and Twilio accounts * Implement password manager * Create incident reporting process * Fix critical vulnerabilities ### 31–60 Days: Policy and Process * Finalize cybersecurity policy * Finalize incident response plan * Conduct staff cybersecurity training * Implement device management * Improve email security * Document asset inventory * Create onboarding and offboarding checklist * Review vendor access ### 61–90 Days: Monitoring and Improvement * Implement monitoring and alerting * Conduct vulnerability scan * Test backup recovery * Conduct incident response tabletop exercise * Review Salesforce and Twilio logs * Perform policy acknowledgement by staff * Prepare executive cybersecurity status report --- ## 9. Final Acceptance Criteria The project will be considered complete when the cybersecurity specialist delivers: 1. Cybersecurity Gap Assessment Report 2. Risk Register 3. Gap Matrix 4. Cybersecurity Incident Response Plan 5. Cybersecurity Policy 6. Tools and Technology Recommendation Report 7. 30/60/90-Day Implementation Roadmap 8. Executive Summary for Management 9. Staff Cybersecurity Awareness Recommendations 10. Prioritized Remediation Plan with estimated cost and urgency All findings must be written in business-friendly language and must clearly explain the weakness, the risk, and the recommended fix 10. Expected Outcome At the end of the engagement, the company should have a clear understanding of its cybersecurity weaknesses, the risks facing its business, the policies required to govern cybersecurity, the response plan needed for incidents, and the tools and technologies required to protect its people, systems, and data.