Security Consultant

Location: Manchester, Leeds, Bristol, Halifax or Edinburgh, UK

Work Arrangement: Hybrid – 2 days per week in the office

Preferred Location: Leeds

We are looking for experienced Cyber Security Consultants to join the Security Consultancy and Design team within the Chief Security Office.

The role will support security-by-design across enterprise change and transformation programmes, providing security consultancy, threat modelling, risk assessment, secure architecture guidance and assurance across a wide range of technology platforms.

The successful candidate will have broad knowledge of cyber security domains, enterprise technologies, security controls and modern architectures.

• Apply Agile methodologies to support engineering teams and deliver multiple product initiatives simultaneously.
• Conduct threat modelling by analysing technical solutions, identifying threats and vulnerabilities, and assessing security risks.
• Evaluate the risks and benefits of different design options to support secure architectural decisions.
• Design secure solutions and document key security controls in accordance with security standards.
• Define security testing requirements and assess security testing findings.
• Provide security direction, governance, assurance and guidance across change initiatives.
• Communicate technical security concepts effectively to technical and non-technical stakeholders.
• Support security-by-design principles across enterprise change and transformation programmes.
• Promote engineering excellence and secure delivery practices.

• Strong knowledge of cyber security domains and enterprise security controls.
• Experience in security consultancy, security design or security architecture.
• Broad understanding of modern enterprise technologies, including cloud and AI.
• Exposure to RESTful APIs, containerised applications and microservices architectures.
• Experience conducting threat modelling and identifying security risks.
• Knowledge of threat modelling frameworks such as STRIDE and MITRE ATT&CK.
• Strong understanding of endpoint security, network security, cryptography and Identity and Access Management (IAM).
• Experience assessing security risks and recommending appropriate controls.
• Ability to evaluate security design options and provide practical recommendations.
• Experience defining security testing requirements and reviewing findings.
• Strong communication, stakeholder management and analytical skills.
• Ability to work effectively in Agile environments and manage multiple initiatives.
• Ability to work hybrid, 2 days per week in the office.

• Awareness of security standards and frameworks, including ISO 27000, PCI DSS, COBIT, NIST and OWASP.
• CISSP, CISM, CCSP or equivalent security management certification.
• CEH, OSCP or equivalent technical security certification.
• Experience working with public and private cloud environments.
• Experience within banking, financial services or other regulated enterprise environments.