Do you want to be part of a force for good, helping to make life better for customers and society in the moments that matter?

At Hodge, we put people at the heart of our business, and that means our customers, colleagues and communities. Hodge is a Welsh financial services provider focused on real estate finance and specialist residential mortgage markets.

The Role

The role of Senior Cyber Security Engineer is to ensure that all internal and external applications, infrastructure, and data are managed in line with cyber and information security best practice and that the estate is pro-actively upgraded and maintained.

The role, under the overall management of the Security Architect, will lead the Cyber Security engagement and activity across Hodge to ensure that new and amended services are built and taken live with the appropriate level of control. Engage with internal and external stakeholders to drive continual improvement of cyber security and related practices.

Essential Criteria

• Relevant IT or computer science degree.
• Experience of working to recognised cyber security and risk framework.
• Experience of implementing relevant tools for Cyber controls.
• Knowledge in IT security best practice, solutions and frameworks.
• Ability to demonstrate understanding of vulnerability remediation.
• Knowledge and experience of developing for AWS or similar cloud platforms.

Key Responsibilities

• Manage implementation and ongoing operation of appropriate cyber security toolset covering user, infrastructure and application activity.
• Manage implementation and operation of vulnerability management processes across applications and infrastructure.
• Work with outsourced security providers to ensure work being undertaken is of required standard and appropriate reporting is available.
• Develop, maintain and manage the Security Controls Catalogue to ensure consistent reporting of risks and controls, and alignment to best practice.
• Develop, maintain and manage the Security Roadmap to provide visibility and control of ongoing security enhancements.
• Ensure that all evidence of controls and cyber operations is maintained to support external and internal audit assessments.
• Ensure appropriate documentation is maintained to support current and future activity.
• Ensure work includes appropriate quality control mechanisms and automated reporting; ensure existing technical controls and process are effective, co-ordinating and remedial work required.
• Lead the security awareness programme for Hodge colleagues ensuring that ongoing learning materials are developed and enhanced as required. Undertake regular testing exercises with colleagues to measure assimilation and awareness.
• Ensure that Cyber security activity undertaken supports visibility, transparency and suitable metrics on cyber controls and activity.
• Undertake assurance assessments of third-party suppliers.
• Manage and report the benefits, risks and alternatives of relevant frameworks, tools and languages.
• Review work of other cyber team members to ensure quality standards are maintained and knowledge transfer.
• Work with Service Delivery and Development teams to assist in the investigation and resolution of live issues and to support BAU activity.
• Work with Service Delivery team to ensure Service Transition controls and documentation are provided in line with agreed Service Transition framework.
• Work with Service Delivery and Technology Project colleagues on implementation and planning of cyber related tools and projects.
• Work with business and IT stakeholders to ensure security provision and tools align with short and longer-term goals.
• Work with software and delivery teams to provide cyber security and controls guidance across development and infrastructure projects.
• Engage with software teams to define controls to be applied as part of software development and delivery.
• Work with delivery teams to agree security NFRs (authentication, confidentiality, integrity, etc.) and ensure required operational controls are defined, agreed, tested and implemented.
• Engage with external suppliers to utilise external expertise where required across delivery and live operation.
• Understand core architectural patterns, frameworks and architecture used by Hodge and understand the security implications.
• Develop and implement threat modelling and risk analysis framework.
• Ensure that defined security standards are applied to all work undertaken (e.g. password policy, authentication standards)
• Work with 3rd party suppliers to manage penetration test planning, execution and evaluation of results.
• Engage with and contribute to relevant cyber and tech community forums.
• Advise and coach other team members to aid their technical and team development.
• Pro-actively investigate technology landscape and best practice to identify improvements.
• Maintain a knowledge of current Cyber technologies and best practice to identify improvements.
• Engage with external parties to share and improve knowledge.