Security Consultant
Location: Manchester, Leeds, Bristol, Halifax or Edinburgh, UK
Work Arrangement: Hybrid - 2 days per week in the office
Preferred Location: Leeds
Role Overview
We are looking for experienced Cyber Security Consultants to join the Security Consultancy and Design team within the Chief Security Office.
The role will support security-by-design across enterprise change and transformation programmes, providing security consultancy, threat modelling, risk assessment, secure architecture guidance and assurance across a wide range of technology platforms.
The successful candidate will have broad knowledge of cyber security domains, enterprise technologies, security controls and modern architectures.
Key Responsibilities
- Apply Agile methodologies to support engineering teams and deliver multiple product initiatives simultaneously.
- Conduct threat modelling by analysing technical solutions, identifying threats and vulnerabilities, and assessing security risks.
- Evaluate the risks and benefits of different design options to support secure architectural decisions.
- Design secure solutions and document key security controls in accordance with security standards.
- Define security testing requirements and assess security testing findings.
- Provide security direction, governance, assurance and guidance across change initiatives.
- Communicate technical security concepts effectively to technical and non-technical stakeholders.
- Support security-by-design principles across enterprise change and transformation programmes.
- Promote engineering excellence and secure delivery practices.
Required Skills and Experience
- Strong knowledge of cyber security domains and enterprise security controls.
- Experience in security consultancy, security design or security architecture.
- Broad understanding of modern enterprise technologies, including cloud and AI.
- Exposure to RESTful APIs, containerised applications and microservices architectures.
- Experience conducting threat modelling and identifying security risks.
- Knowledge of threat modelling frameworks such as STRIDE and MITRE ATT&CK.
- Strong understanding of endpoint security, network security, cryptography and Identity and Access Management (IAM).
- Experience assessing security risks and recommending appropriate controls.
- Ability to evaluate security design options and provide practical recommendations.
- Experience defining security testing requirements and reviewing findings.
- Strong communication, stakeholder management and analytical skills.
- Ability to work effectively in Agile environments and manage multiple initiatives.
- Ability to work hybrid, 2 days per week in the office.
Desirable Skills
- Awareness of security standards and frameworks, including ISO 27000, PCI DSS, COBIT, NIST and OWASP.
- CISSP, CISM, CCSP or equivalent security management certification.
- CEH, OSCP or equivalent technical security certification.
- Experience working with public and private cloud environments.
- Experience within banking, financial services or other regulated enterprise environments.