Cyber Security Controls Tester (Contractor)

Cyberfort; City Of London; Remote; GBP 92,000 - 148,000; Full time

Job summary

Cyberfort is seeking an experienced Cyber Security Controls Tester for a remote UK contract position. You will support a large-scale security assurance programme, evaluating the effectiveness of controls and ensuring compliance with ISO 27001, NIST CSF, and NIST 800-53 within a regulated environment.

You will document testing activities, prepare comprehensive assurance reports, and provide remediation guidance to enhance security posture.

Qualifications

• Experience testing security controls in complex environments.
• Knowledge of ISO 27001, NIST CSF, NIST 800-53, and CIS Controls.
• Ability to produce test plans and assurance reports for stakeholders.

Responsibilities

• Evaluate effectiveness of security controls against standards and design docs.
• Test controls across networks, IAM, encryption and endpoint security.
• Review policies, configurations and procedures to identify weaknesses.
• Develop test plans, evidence, and assurance reports for risk teams and architects.
• Present findings and remediation actions to technical and business stakeholders.

Skills

Security controls testing

Stakeholder engagement

Documentation & reporting

Risk management

Compliance awareness

Job description

Location: Fully Remote (UK)

Contract Type: Contract

Contract Length: Immediate start until February 2027

Security Clearance: Active SC Clearance required and must be verifiable

About the Opportunity

We are seeking an experienced Cyber Security Controls Tester to support a large-scale security assurance programme within a highly regulated environment. This is an excellent opportunity for a contractor with a strong background in security controls testing, assurance and risk management, particularly within central government or wider public sector environments.

What You'll Be Doing

• Evaluating the effectiveness of security controls within the identified environment to ensure they meet the standards defined within supporting documentation, including High-Level Designs (HLDs), Low-Level Designs (LLDs) and Controls Catalogues.


• Testing controls against recognised security frameworks and standards, including ISO 27001, NIST CSF and NIST 800-53.


• Reviewing policies, procedures, network configurations, firewall rules, identity and access management controls, and other technical and procedural security controls.


• Applying recognised controls testing methodologies, including documentation reviews, walkthroughs, sampling and technical verification activities.


• Agreeing testing scope and plans with stakeholders, risk teams and security architects to ensure assurance activity addresses key security concerns.


• Assessing both the design effectiveness and operating effectiveness of implemented security controls.


• Providing pragmatic remediation guidance and recommendations to address identified control weaknesses.


• Supporting improvements to policies, processes and security controls to strengthen the overall security posture of services and environments.


• Maintaining clear documentation of testing activities, evidence collected, findings and remediation recommendations.


• Producing comprehensive assurance reports outlining security posture, findings, risks and recommendations.


• Presenting findings to technical and non-technical stakeholders and agreeing remediation actions where required.


• Working closely with risk and security architecture teams to ensure controls testing supports wider risk management and assurance objectives.

What We're Looking For

You will be a detail-oriented cyber security professional with experience assessing and validating security controls across complex technical environments. You'll be comfortable engaging with both technical and business stakeholders and have the ability to provide clear, evidence-based assurance and practical recommendations.

Essential Skills & Experience

• Demonstrable experience testing and evaluating the effectiveness of technical, procedural and physical security controls within complex environments.


• Strong working knowledge of security control frameworks including ISO 27001, NIST CSF, NIST 800-53 and CIS Controls.


• Experience conducting controls testing, assurance or audit activities against recognised security frameworks.


• Hands-on experience reviewing and testing:
  
  
  • Network configurations
  
  
  • Firewall rulesets
  
  
  • Identity and Access Management (IAM) controls
  
  
  • Encryption controls
  
  
  • Endpoint security controls
  
  
  
  


• Familiarity with security design and controls documentation including HLDs, LLDs and Controls Catalogues.


• Experience applying recognised testing methodologies, including documentation reviews, walkthroughs, sampling and evidence-based assurance activities.


• Strong understanding of relevant legislation and compliance requirements, including GDPR, PCI DSS and ICO guidance.


• Working knowledge of HMG and NCSC security policies, standards and guidance.


• Ability to produce clear, well-structured test plans, assurance reports and remediation recommendations.


• Strong stakeholder management and communication skills, with experience engaging risk teams, security architects and business stakeholders.


• Strong analytical and problem-solving skills, with a methodical approach to identifying, evidencing and reporting security control weaknesses.

Desirable Skills & Certifications

• CISA certification.


• ISO 27001 Lead Auditor or Lead Implementer certification.


• CRISC certification.


• CompTIA Security+ or similar security assurance-related certification.


• Experience working within central government or public sector environments.


• Experience supporting governance, risk and compliance (GRC) programmes.


• Exposure to cloud security assurance across Azure and AWS environments.


• Experience supporting IT Health Checks (ITHCs), penetration testing exercises or security accreditation activities.

Please note: Active SC Clearance is a mandatory requirement for this role and must be current and capable of being validated.

Locations Remote