Senior Security Engineer
Work with automated scanning and manual testing tools, CSPM, SIEM, and vulnerability management platforms; AWS, Azure, or GCP. As a Senior in the Cyber practice, you design and lead security audits, risk assessments (ISO 27005, NIST RMF, STRIDE, MITRE ATT&CK), and threat-modeling across UK government systems requiring compliance with GovAssure, the NCSC Cyber Assessment Framework, UK GDPR, and NIS Regulations. You will mentor colleagues and help clients build internal security capability.
Free Tailor for ATS: 10/10 runs left
We help UK public sector organisations build and run digital services that are secure, trustworthy, and resilient. As a Senior Security Engineer in our Cyber practice, you will need to be able to take end-to-end ownership of securing the systems we build; embedding security into delivery pipelines and building the tooling and automation that keep complex government services safe by default.
This is a hands-on engineering role with real scope. You will work across client engagements where the stakes are high; services handling sensitive citizen data, cloud-native systems built on AWS, Azure or GCP, and delivery teams shipping continuously under regulatory pressure (NCSC CAF, NIS Regulations, HMG Security Policy Framework). You will not be filling in compliance checklists; you will be building the controls, pipelines, and patterns that make secure delivery the path of least resistance.
As a senior engineer, you will be expected to raise the bar on engineering practices around you; through the code and infrastructure you ship, the patterns you set, and by mentoring colleagues and client engineers, we believe security is a continuous engineering concern. You'll be central to making that real.
Key Responsibilities
Build secure architectures for cloud-native systems — applying secure-by-design patterns, zero-trust principles, and least-privilege access across AWS, Azure, or GCP environments.
Embed security into CI/CD pipelines, integrating SAST, DAST, SCA, and infrastructure-as-code scanning so vulnerabilities are caught before they ship, not after.
Support threat modelling and design reviews with engineering teams, using structured methods (STRIDE, MITRE ATT&CK) to identify risks early and influence architecture decisions directly.
Build and maintain security tooling and automation from policy-as-code and IaC guardrails (Terraform, OPA/Conftest) to custom scripts and integrations that scale good security practice across teams.
Support vulnerability management by triaging findings from scanning and pentest engagements, prioritising by exploitability and impact, and applying mitigation and remediations.
Support incident response readiness — building detection and alerting into systems, running exercises, and improving playbooks based on what's actually observable in the stack.
Mentor and pair with engineers, sharing secure coding and secure design practices directly in the codebase, and helping client teams build their own security engineering capability over time.
Contribute to the commercial and technical health of engagements, flagging architectural risk early and surfacing opportunities to strengthen a client's security posture through better engineering, not more process.
Skills, Knowledge & Expertise
Essential
Strong hands-on experience securing cloud infrastructure in AWS, Azure, or GCP, including IAM design, network security, and secrets management.
Experience embedding security tooling into CI/CD pipelines (SAST, DAST, SCA, container/IaC scanning).
Proficiency in at least one scripting/programming language (Python, Go, or similar) for building security automation and tooling.
Experience with detection engineering, creating and managing data streams (Cribl, Kinesis) and SIEM tooling (Splunk, QRadar, Sentinel, ArcSight) , or building alerting/observability for security events from across an enterprise.
Experience setting up segregated and secured hypervisor environments for the testing of potentially malicious software or code.
Desirable
Certifications such as OSCP, AWS/Azure/GCP security specialty certifications,
Experience with infrastructure-as-code (Terraform, CloudFormation, Pulumi) and policy-as-code enforcement (OPA, Sentinel, Checkov).
Experience supporting penetration testing and vulnerability scanning, and working closely with teaming team members to mitigate or remediate findings.
Working knowledge of container and Kubernetes security, image hardening, admission controls, runtime protection.
Familiarity with UK government security frameworks (GovAssure, NCSC Cyber Assessment Framework, HMG SPF)
Experience contributing reusable security patterns, tooling, or paved-road templates back into an engineering practice.
Evidence of mentoring engineers on secure coding and secure design, including pairing, code review, or internal training.
Experience co-designing solutions with engineering teams and stakeholders
What you will bring:
Engineering-first instincts. You would rather fix a systemic issue with a pipeline check or a paved road than write another finding in a report.
A team-first mindset. You pair, you share, you coach — and you make it safe for engineers to ask "is this secure enough?" without getting a lecture.
Confidence communicating across boundaries. You can go from a Terraform PR review to explaining risk trade-offs to a delivery lead without switching brains.
Genuine ownership. You see security work through from beginning to the end, recognising the importance of ownership of a solution, not just recommending actions along the way.