Security Consultant - H&PS

In this Security Consultant role, you will help reduce cyber risk across technology projects by embedding security requirements, controls, and monitoring throughout delivery. You will conduct threat modelling, align with frameworks like MITRE ATT&CK, and translate laws and standards into practical security needs for project teams. You’ll collaborate with cross-functional stakeholders to ensure ongoing assurance and governance. This role offers exposure to cutting-edge security work in health, public sector, defence and central government, with opportunities to grow inside a global advisory network.

• 25–30 days vacation
• private medical insurance
• 3 extra days leave for charitable work
• extensive benefits package
• mobility/onsite client work

• Embed security controls and risk management throughout the project lifecycle
• Conduct threat modelling aligned with MITRE ATT&CK to identify threats and define controls
• Define monitoring and logging to detect control failures and incidents in live environments
• Support procurement by developing security requirements and contractual security schedules
• Maintain traceability of security obligations, threats, controls, testing, risks, and decisions
• Provide assurance evidence to support risk decisions at go-live and in-service stages
• Translate laws, policies, standards into practical security requirements for project teams
• Support governance by ensuring security requirements are understood, implemented, and evidenced throughout delivery
• Collaborate with project teams to embed security into design through to operation

• Strong technical knowledge in at least one: Public cloud, Application security, Networking, On-premises infrastructure
• Understanding of threat modelling, security controls, and risk analysis principles
• Ability to assess risks and recommend proportionate controls and monitoring
• Experience across cloud, hybrid, third-party, and non-standard environments
• Familiarity with at least one recognised security framework
• Ability to validate security assumptions through evidence-based activities (security testing, configuration reviews, investigations)
• Strong analytical and problem-solving skills to base recommendations on technical evidence
• Ability to translate technical concepts into practical guidance for delivery teams
• Comfort with varying levels of service complexity and autonomy (SFIA levels 3–5)

• Analytical thinking
• Problem-solving
• Effective communication
• Public cloud
• Application security
• Networking