Secure Software Development and DevSecOps

• Integrate security checks into CI/CD pipelines and release processes.
• Support software composition analysis, secrets detection, static analysis and container-image scanning.
• Establish security acceptance criteria for releases and document residual risks.
• Work with software engineers to remediate vulnerabilities without unnecessarily disrupting delivery.
• Maintain secure configuration baselines and support infrastructure-as-code security reviews.
• Help establish auditable release, change-management and deployment practices.

AI and Data Security

• Review the security implications of LLM integrations, AI orchestration, retrieval-augmented generation and external model services.
• Assess data flows involving prompts, outputs, embeddings, document stores, caches, telemetry and logs.
• Help implement appropriate controls for data classification, retention, access, encryption and deletion.
• Assess prompt injection, insecure tool use, data leakage, excessive agent permissions and other AI-specific attack paths.
• Support controls that prevent unauthorised use of project data for model training or unrelated processing.
• Ensure that AI-generated outputs, where relevant, are subject to appropriate validation, traceability and human oversight.

Security Assurance and Compliance Evidence

• Translate applicable contractual security requirements into a control implementation and evidence matrix.
• Prepare and maintain security architecture documents, threat models, risk registers, configuration records and remediation plans.
• Support security reviews, technical assurance activities and responses to customer security findings.
• Maintain traceability between requirements, implemented controls, test results and supporting evidence.
• Support relevant organisational security assessments and improvement plans.
• Work with the project team to identify security gaps early and track them through to closure or formally accepted remediation.

Defence and Government Security

• Work within the security instructions, information-handling rules and access restrictions applicable to each assigned project.
• Support the implementation of customer-approved security requirements and operational procedures.
• Identify when a proposed design, hosting arrangement, service or integration requires additional approval.
• Escalate security incidents, suspected data exposure and material control failures through the designated process.
• Cooperate with authorised customer security personnel and assurance representatives.
• Maintain appropriate separation between development, testing and environments handling protected information.

Essential Requirements

Candidates must demonstrate:

• Active, valid UK SC clearance, subject to verification through the appropriate authorised process.
• Substantial practical experience in cybersecurity engineering, secure systems engineering, infrastructure security or a closely related discipline.
• Strong understanding of security architecture, threat modelling and risk-based control implementation.
• Hands-on experience with identity and access management, least privilege, authentication and privileged access.
• Practical experience with vulnerability management, secure configuration and security remediation.
• Understanding of secure software development and DevSecOps practices.
• Experience with security logging, monitoring, auditability and incident-response processes.
• Familiarity with cloud security, containers, APIs and modern application architectures.
• Ability to produce clear technical documentation and evidence that supports independent security review.
• Strong problem-solving skills and the ability to work collaboratively with developers, architects and project stakeholders.
• A disciplined approach to handling sensitive information and complying with security procedures.

Desirable Experience

The following would be advantageous:

• Experience supporting UK government or Ministry of Defence technology programmes.
• Experience with systems subject to formal security assurance or accreditation.
• Familiarity with UK government security policies and relevant NCSC guidance.
• Experience with AWS, Microsoft Azure, IBM Cloud or other enterprise cloud environments.
• Familiarity with IBM watsonx, LLM application architectures or enterprise AI platforms.
• Experience with Kubernetes, Docker, infrastructure as code and automated security tooling.
• Knowledge of data classification, cryptographic controls, key management and secure data handling.
• Experience with ISO 27001, Cyber Essentials Plus or other relevant security frameworks.
• Experience with security requirements traceability, technical risk registers and remediation tracking.
• Relevant security, cloud or infrastructure certifications.

Initial Deliverables

During the initial engagement, the engineer will be expected to contribute to:

• A security architecture and threat model for the assigned system and deployment environment.
• A security requirements and controls matrix mapped to the applicable contractual requirements.
• An assessment of the existing security posture, including prioritised findings and remediation recommendations.
• A secure configuration baseline covering identity, access, logging, secrets and deployment controls.
• A vulnerability-management and remediation workflow with clear ownership and verification.
• Security checks integrated into the engineering and release lifecycle, where appropriate.
• An evidence pack containing relevant architecture documents, test results, control records and outstanding risks.
• A documented security handover and recommendations for ongoing operational assurance.

Deliverables and acceptance criteria will be agreed with the successful candidate in line with the actual project scope and customer requirements.

Working Expectations

• Work closely with the company leadership and technical delivery team.
• Communicate security risks clearly, with practical remediation options and prioritisation.
• Maintain accurate records of security decisions, control implementation and outstanding issues.
• Avoid unsupported claims about compliance, accreditation or security effectiveness.
• Distinguish implemented and tested controls from planned controls and documented policies.
• Do not access, transfer or process classified or otherwise restricted information except where the individual, organisation, systems and environment are appropriately authorised.
• Follow applicable contractual, legal and organisational security requirements.

CyberFortis Consulting Limited is committed to secure-by-design engineering, responsible AI development and rigorous technical assurance.