Lead Security by Design Consultant

Lead Security by Design Consultant - Defence Aviation

Location: Yeovil - minimum 3 days onsite per week, increasing where programme requirements demand
Rate: £120.37 per hour, Outside IR35
Duration: 12 months
Clearance: Active SC required
Nationality: Sole British citizens only due to programme requirements

We're recruiting a Lead Security by Design Consultant to support a major defence aviation programme from its early stages, shaping cyber and information security across the engineering lifecycle, from requirements and design through to in-service support.

Working alongside security consultants, engineers and product specialists, you'll lead the development of security deliverables and translate customer requirements into practical plans, controls and assurance activities.

Key responsibilities

• Lead the production and maintenance of Security Management Plans, security cases, assurance artefacts and cyber security risk reports.

• Translate customer security requirements into actionable plans, statements of work and engineering lifecycle activities.

• Conduct technical security risk assessments, threat modelling and vulnerability analysis, identifying appropriate mitigations.

• Provide security guidance to product engineers, system architects and developers across software, firmware and electronic hardware.

• Scope and manage security verification and validation activities and associated remediation plans.

• Manage technical and delivery risks, customer relationships and contributions to security working groups.

• Deliver agreed security outputs to time, cost and quality requirements.

Skills and experience required

• Experience delivering security outcomes within defence, including experience in defence aviation.

• Strong knowledge of MOD accreditation and Secure by Design processes, including ISN2023/09.

• Experience with high-integrity software and embedding secure software design into established development lifecycles.

• Practical application of Defence Standards 05-138 and 05-139, alongside NIST guidance such as SP 800-30, 800-37 and 800-53.

• Supply chain security risk management experience using NIST SP 800-161 or ISO 28000.

• Experience developing and reviewing system security designs and translating security requirements into system or process controls.

• Strong stakeholder management and communication skills, with the ability to work independently and guide technical teams.

• A relevant degree in cyber security, systems or software engineering, or comparable professional experience.

• At least two recognised cyber security certifications and/or relevant chartered status, such as CISSP, CISM, CASP/SecurityX or ChCSP.

Desirable experience

• Engineering lifecycle reviews, including SRR, PDR, CDR and TRR.

• ARP4754A/ARP4761 and their relationship with security.

• RTCA DO-326A/B, DO-355A and DO-356A.

To apply, please submit your CV outlining your relevant defence aviation and security engineering experience.