Security Specialist (Cyber Assurance and Security Engineering)

Our client, a defence prime, needs a security professional to lead an integrated security workstream covering cyber assurance, project security and security engineering. You will build and assure the project security case and challenge supplier evidence. The role is hybrid, with travel to supplier and operational sites as required, and requires SC clearance.

What you will do

• Lead and coordinate the integrated security workstream, keeping a plan of activities aligned to project milestones and design reviews.
• Develop, maintain and assure the project security case and supporting risk evidence, keeping risks, assumptions, dependencies, controls and residual risk decisions traceable.
• Apply Secure by Design and cyber assurance principles, including self-assessment, plans of action and milestones, threat and vulnerability analysis and continual assurance planning.
• Review and challenge supplier security architecture, requirements, designs, test evidence and technical submissions.
• Identify assurance gaps and define proportionate corrective actions, tracking them through to closure.
• Provide project and protective security advice on classification, security aspects, supply-chain security, information handling, cryptography and external system interfaces.
• Plan and support security working groups and engagement with assurance stakeholders.
• Prepare submissions, briefings and security input to approval and acceptance packs for operation up to UK SECRET.

What you will bring

• Demonstrable security profession experience in at least two of cyber assurance, project security and security engineering, with the ability to integrate all three.
• Experience developing or assuring security cases, security risk assessments and evidence for complex defence, government or similarly regulated systems.
• Practical knowledge of Secure by Design, cyber risk management, threat and vulnerability assessment, security controls and continual assurance across an acquisition lifecycle.
• Ability to review technical and supplier evidence, identify assurance gaps, give constructive challenge and turn findings into clear, owned, time-bound actions.
• Strong written and verbal communication, including concise governance papers, assurance arguments, working-group outputs and senior stakeholder briefings.
• Current SC clearance, or eligibility and willingness to obtain and maintain the clearance required.

Nice to have

• Experience of defence acquisition, its governance and assurance processes, and defence security policy and standards.
• Experience of operational technology, radar, command-and-control, safety-related or other mission-critical systems.
• Professional registration or recognised security qualification, such as Chartered status, CISSP, CISM, CCP or equivalent.
• Experience of supply-chain assurance, protective security, cryptographic planning, penetration-test evidence and transition into service.