Qualifications

• Relevant education or industry-recognised certifications in cybersecurity, information assurance, secure engineering, security architecture, risk management or a related discipline.
• Suitable qualifications may include BSc, MSc, CISSP, CISM, CRISC, CISA, CCP, ISO 27001 Lead Implementer/Lead Auditor, Security+, CySA+, SABSA, TOGAF, IEC 62443, NCSC CAF-related experience or equivalent professional experience.
• Experience working within UK MOD, defence, maritime, shipbuilding, naval, critical national infrastructure or operationally critical environments would be highly beneficial.

Essential skills

• Demonstrable ownership of a Security Management Plan, product security management plan, security case or equivalent controlling assurance artefact.
• Strong understanding of secure-by-design principles and their application across complex engineering lifecycles.
• Ability to lead security input into formal engineering design reviews and technical governance forums.
• Ability to translate security risks and regulatory expectations into practical engineering, architecture and delivery actions.
• Strong stakeholder management skills, including the ability to influence senior technical and programme stakeholders.
• Strong written and verbal communication skills, with the ability to produce concise technical assurance material, risk statements, executive briefings and decision papers.
• Ability to work independently and provide senior technical direction without day-to-day supervision, and to direct the work of other consultants.
• Awareness of maritime cyber assurance benchmarks such as IACS Unified Requirements E26 and E27, and of the Defence Maritime Regulator's assurance framework.

Experience

• Proven experience in a senior cybersecurity, product security, information assurance, or secure engineering role.
• Experience supporting major defence, maritime, naval, shipbuilding, CNI or complex engineering programmes.
• Experience defining or maintaining a Security Management Plan, Product Security Management Plan, Security Case, accreditation pack or equivalent assurance artefact.
• Experience embedding cybersecurity across the full engineering lifecycle, from requirements and design through to build, integration, validation and acceptance.
• Experience leading security input into design reviews, technical governance forums and assurance gates.
• Experience developing and maintaining security risk registers, treatment plans, control evidence and assurance records.
• Experience supporting MOD, NCSC, defence or maritime compliance activity.
• Experience defining supplier security requirements and assessing third-party security evidence.
• Experience operating within Integrated Project Teams or multi-disciplinary engineering delivery environments.
• Experience handling sensitive defence information in line with UK MOD, NCSC, client security and data protection requirements.
• Practical experience applying MOD Secure by Design, NCSC, defence security, information assurance or risk management frameworks.
• Experience conducting threat modelling, security risk assessment and security requirements definition, using recognised methods such as STRIDE, MITRE ATT&CK for Industrial Control Systems, NIST SP 800-30 or ISO/IEC 27005.
• Experience securing complex IT and OT systems, including platform systems, industrial control systems, networks, communications and support environments.
• Experience supporting security accreditation, assurance, compliance or certification activities in a UK defence or similarly regulated environment.
• Cybersecurity experience within defence, maritime, shipbuilding, critical national infrastructure, or operationally critical environments.
• Strong supplier and third-party oversight experience, including security requirements definition, deliverable review, dependency management and acceptance criteria.
• Experience with MOD security policy, defence standards, JSPs, Secure by Design, NCSC guidance or equivalent assurance frameworks.
• Experience with autonomous, uncrewed or remotely operated platforms, and the safety and availability considerations these create.
• Experience with IEC 62443, NIST CSF, ISO 27001, NCSC CAF, Def Stan 05-138 or DEFCON security conditions.
• TEMPEST awareness or experience, particularly as it relates to defence standards, secure design and NCSC guidance.
• Experience contributing to executive-level security reporting, assurance dashboards, risk briefings or programme decision packs.
• Experience scoping IT health checks, penetration testing or technical assurance activity as follow-on work.
• Strong experience operating in a senior product security, cyber assurance, information assurance, secure engineering or security architecture role.

What do I need before I apply

• Have the right to work in the UK.
• Hold, or be eligible to obtain, UK Security Check (SC) clearance. Clearance is a mandatory requirement for this programme, and applicants must meet the UK residency criteria for security clearance.
• Be willing and able to work in a hybrid model, including client site attendance as required.
• Be comfortable working within secure collaboration environments and handling information marked up to OFFICIAL-SENSITIVE.
• Be able to work under the terms of applicable confidentiality and non-disclosure arrangements.

Benefits

• Collaborative working environment – we stand shoulder to shoulder with our clients and our peers through good times and challenges
• We empower all passionate technology loving professionals by allowing them to expand their skills and take part in inspiring projects
• Expleo Academy - enables you to acquire and develop the right skills by delivering a suite of accredited training courses
• Competitive company benefits
• Always working as one team, our people are not afraid to think big and challenge the status quo
• As a Disability Confident Committed Employer we have committed to:
  • Ensure our recruitment process is inclusive and accessible
  • Communicating and promoting vacancies
  • Offering an interview to disabled people who meet the minimum criteria for the job
  • Anticipating and providing reasonable adjustments as required
  • Supporting any existing employee who acquires a disability or long term health condition, enabling them to stay in work at least one activity that will make a difference for disabled people
• “We are an equal opportunities employer and welcome applications from all suitably qualified persons regardless of their race, sex, disability, religion/belief, sexual orientation or age”.
• We treat everyone fairly and equitably across the organisation, including providing any additional support and adjustments needed for everyone to thrive