Lead Security by Design Consultant

Key responsibilities

• Lead the production and maintenance of Security Management Plans, security cases, assurance artefacts and cyber security risk reports.
• Translate customer security requirements into actionable plans, statements of work and engineering lifecycle activities.
• Conduct technical security risk assessments, threat modelling and vulnerability analysis, identifying appropriate mitigations.
• Provide security guidance to product engineers, system architects and developers across software, firmware and electronic hardware.
• Scope and manage security verification and validation activities and associated remediation plans.
• Manage technical and delivery risks, customer relationships and contributions to security working groups.
• Deliver agreed security outputs to time, cost and quality requirements.

Skills and experience required

• Experience delivering security outcomes within defence, including experience in defence aviation.
• Strong knowledge of MOD accreditation and Secure by Design processes, including ISN2023/09.
• Experience with high-integrity software and embedding secure software design into established development lifecycles.
• Practical application of Defence Standards 05-138 and 05-139, alongside NIST guidance such as SP 800-30, 800-37 and 800-53.
• Supply chain security risk management experience using NIST SP 800-161 or ISO 28000.
• Experience developing and reviewing system security designs and translating security requirements into system or process controls.
• Strong stakeholder management and communication skills, with the ability to work independently and guide technical teams.
• A relevant degree in cyber security, systems or software engineering, or comparable professional experience.
• At least two recognised cyber security certifications and/or relevant chartered status, such as CISSP, CISM, CASP/SecurityX or ChCSP.

Desirable experience

• Engineering lifecycle reviews, including SRR, PDR, CDR and TRR.
• ARP4754A/ARP4761 and their relationship with security.
• RTCA DO-326A/B, DO-355A and DO-356A.