Job Search

We are seeking a Consultant – Information Assurance & Secure by Design to provide expert advice on the development, implementation and continuous improvement of secure information systems. You will work with technical and non-technical stakeholders to ensure that security, privacy and resilience are considered from the earliest stages of product, service and technology development.

You will assess business and technical requirements, identify information and cyber security risks, and recommend proportionate controls in line with relevant policies, standards and regulatory obligations. The role will involve contributing to security architectures, assurance cases, risk assessments, threat modelling, security reviews and design approvals across a varied portfolio of projects and services.

Key responsibilities will include advising delivery teams on secure-by-design principles; reviewing proposed solutions and technical documentation; supporting security governance and risk acceptance processes; and monitoring the effective implementation of agreed controls. You will help establish repeatable assurance methods, produce clear reports for senior stakeholders, and provide constructive challenge where designs or delivery approaches may introduce unacceptable risk.

You will also contribute to the development of security policies, standards, guidance and patterns, while helping to promote a strong culture of information assurance. The role may include supporting audits, responding to security incidents, evaluating suppliers and third-party services, and ensuring that lessons learned are incorporated into future designs and operating practices.

To succeed, you will have demonstrable experience in information assurance, cyber security, risk management or secure solution design. You should be confident interpreting security requirements and translating them into practical recommendations. Experience of recognised frameworks, standards or methods such as ISO 27001, NIST, Cyber Essentials, SABSA, TOGAF or the NCSC principles would be advantageous.

Strong communication, influencing and analytical skills are essential, along with the ability to manage competing priorities and work collaboratively across multidisciplinary teams. Relevant professional certifications or memberships, such as CISSP, CISM, CRISC, or equivalent experience, would be desirable.

An opportunity is available for a Consultant – Information Assurance & Secure by Design to help embed robust security, privacy and risk management throughout the design and delivery of digital services. You will provide expert advice across the full service lifecycle, ensuring that security considerations are addressed early and remain aligned with business objectives, regulatory obligations and user needs.

Key responsibilities will include conducting information assurance reviews, security risk assessments and threat modelling activities; defining appropriate security controls; and producing clear, evidence-based recommendations for technical and non-technical stakeholders. You will support the development of secure-by-design patterns, assurance cases, risk treatment plans and governance documentation, while tracking actions through to completion.

The role will involve working closely with architects, delivery teams, product owners, suppliers and senior stakeholders to identify security requirements and assess proposed designs, technologies and changes. You will contribute to security and privacy impact assessments, support audit and compliance activities, and help verify that services meet relevant policies, standards and regulatory expectations. You may also be required to advise on incident preparedness, third-party risk and the secure management of information assets.

Applicants should have proven experience in information assurance, cyber security, risk management or a closely related discipline, with a strong understanding of secure-by-design principles and risk-based decision-making. Experience of applying recognised frameworks and standards, such as ISO 27001, NIST, UK Government security principles or NCSC guidance, would be valuable. Knowledge of data protection requirements, including UK GDPR, is also desirable.

You will be an analytical and confident communicator, able to explain complex risks clearly and influence decisions at all levels. The ability to manage competing priorities, challenge constructively and work collaboratively across multidisciplinary teams is essential. Relevant professional qualifications or certifications, such as CISSP, CISM, CRISC, SABSA or equivalent experience, would be advantageous.