Lead Security Assurance Engineer

Salary: £90,000 - 90,000 per year

Requirements

• Hold one of the following: Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), or an equivalent senior audit and assurance credential.
• Experience establishing and operating vulnerability management programmes at organisational scale, including risk-based prioritisation using EPSS, KEV, and asset criticality, and managing remediation across multiple delivery teams.
• Evidence of leading compliance programmes against UK government frameworks such as GovAssure, CAF, Cyber Essentials, and HMG Security Policy Framework in a complex multi-supplier or multi-team environment.
• Experience conducting or coordinating security audits in UK public sector contexts, including producing formal findings and briefings for senior government stakeholders.
• Working knowledge of exposure management beyond CVE-only approaches, incorporating misconfiguration, identity exposure, and attack-path analysis using cloud-native tooling such as AWS Inspector, GuardDuty, and Security Hub or equivalents.
• Experience assessing and assuring supply chain security, including third-party and vendor risk, and integrating supplier risk into wider assurance and governance programmes.
• Experience building or shaping security assurance capability within a consultancy, programme delivery, or multi-client environment, including growing technical security skills in colleagues and client teams.
• Evidence of acting as a trusted adviser to senior client stakeholders, anchoring security recommendations on client outcomes, challenging briefs constructively, and making security value visible rather than reporting activity.
• Experience setting team ways of working in iterative delivery environments, including establishing retrospective cadences, collaborative problem-solving norms, and pairing practices that spread security knowledge across the team.
• Familiarity with structured threat modelling approaches such as STRIDE, MITRE ATT&CK, and attack trees, and experience embedding these into agile delivery ceremonies.
• Experience integrating SAST, SCA, dependency scanning, and container security tooling into CI/CD pipelines as part of a shift-left security approach.
• If not yet holding the listed credentials, we welcome applicants actively working toward them or demonstrating equivalent capability through experience.
• SC eligibility is required, meaning 5 years UK residency and 5 years employment history (or back to full-time education).

Responsibilities

• Own end-to-end assurance across engagements.
• Establish risk-based assurance frameworks, coordinate audit programmes, and maintain living evidence of control effectiveness, feeding findings into vulnerability management backlogs and governance reporting.
• Lead vulnerability management as a programme, define prioritisation frameworks, set remediation SLAs, own the risk-acceptance register, negotiate remediation plans, and report programme KPIs to senior stakeholders.
• Drive security into the teams normal rhythm by embedding threat modelling, secure code review, SAST, SCA, dependency policy, and container scanning into design and delivery cycles.
• Apply UK government security standards proportionately across engagements, including the NCSC Cyber Assessment Framework, GovAssure, Cyber Essentials, HMG Security Policy Framework, UK GDPR, and NIS Regulations.
• Engage with government security communities and coordinate with departmental security teams.
• Communicate security risk in ways that drive decisions, tailoring reports for senior client stakeholders and showing trends over time.
• Set the standard for incident response and detection readiness, drive incident response practices, own the IR-to-vulnerability-management feedback loop, and coordinate cross-team exercises.
• Mentor colleagues across the practice and at client organisations, pair on complex assurance work, and create structured development opportunities for client engineers.
• Contribute to our Cyber practice beyond delivery by shaping standards, contributing to hiring and calibration, sharing expertise externally, and helping grow our security assurance community.

Technologies

• AWS
• CI/CD
• Cloud
• Embedded
• Security
• Support

More

We help UK government and public sector organisations build better digital services, with security at the centre of that mission. As part of our Cyber practice, you will be embedded in multidisciplinary teams working on complex government programmes that handle sensitive data and serve citizens. We offer a flexible and evolving benefits package, including 30 days of paid annual leave, flexible working hours, flexible parental leave, part-time remote working for all staff, paid counselling, and a flexible benefit platform with options such as a Smart Tech scheme, Cycle to Work scheme, health cash plan, or pension plan. We also run an optional social and wellbeing calendar and encourage applications from people of all backgrounds and experiences. Successful candidates must be eligible for SC clearance, and we hire directly rather than through external recruitment agencies.

last updated 30 week of 2026