Cyber Security Consultant - Incident and Vulnerability Management

Duration: 30/11/2026
Pay: up to £610 per day (umbrella)
Location: Preston, London or Birmingham UK, Hybrid - 30% office 70% home

CONTRACTOR MUST BE MOD SC CLEARED AND BE A SOLE UK NATIONAL

Role Summary

The Security Incident & Vulnerability Management Consultant operates within the Operational Integrator (OI) function to support the transition to a multi-supplier (SIAM) model within a Defence environment.

The role focuses on understanding, aligning and governing existing high-severity security incident management (S3/S4) and vulnerability management processes across suppliers. Ensuring a consistent, risk-based approach in line with client policy and regulatory requirements, supported by appropriate evidence.

The outcome is a coherent, evidence-driven view of security risk, covering both active incidents and underlying vulnerabilities, with processes standardised and ready for BAU handover.

This is a governance and coordination role, not a hands-on SOC, incident response, or vulnerability remediation function.

Key Responsibilities

Governance & Process Alignment

• Review and align existing supplier processes for:
  • High-severity incident management (S3/S4)
  • Vulnerability management, across suppliers from existing processes
• Ensure Processes Are
  • Consistent across suppliers
  • Aligned to client policy and regulatory requirements
• Establish And Govern
  • Incident severity classification and escalation thresholds
  • Vulnerability prioritisation approaches (e.g. CVSS, KEV, EPSS)
  • Exception and risk acceptance processes
• Supplier Coordination (SIAM Model)
  • Coordinate multiple suppliers to ensure consistent handling of incidents and vulnerabilities
  • Act as the integration point across suppliers, aligning outputs without redesigning underlying processes into a common model
  • Identify and manage gaps in process maturity, coverage, data quality and Compliance with standards
• Incident Management (S3/S4 Focus)
  • Govern the lifecycle of high-severity incidents, including escalation, coordination, communication and reporting
  • Ensure suppliers:
    • Detect and escalate incidents appropriately
    • Meet defined escalation and communication expectations
    • Maintain structured incident records
  • Define and agree the required level of visibility from SOC outputs, without requiring direct tooling access
• Vulnerability Management (SOC-led)
  • Oversee the vulnerability lifecycle from identification through to closure
  • Ensure vulnerabilities are:
    • Prioritised consistently using agreed Client approaches
    • Tracked through remediation or formal risk acceptance
• Validate, Track And Monitor
  • Remediation timelines and SLA adherence
  • Handling of high risk vulnerabilities, exceptions and waivers
  • Identify risks relating to:
    • Incomplete asset coverage
    • Obsolescent, legacy or non-patchable systems
• Evidence & Assurance
  • Define and align evidence requirements for both:
    • Incident management (event, escalation, response, closure)
    • Vulnerability management (identify, track, remediate, validate)
  • Ensure outputs are
    • Consistent across suppliers
    • Traceable to risks and controls
    • Audit ready
  • Provide assurance that both domains align with ISMS and control requirement
• Reporting & Transition Support
  • Support Domain-specific Reporting For
    • Major incidents (S3/S4)
    • Vulnerability risk and remediation status
  • Support governance forums with clear, evidence-based reporting
  • Establish a transition baseline that enables a clean handover of processes to BAU without redesign