Cyber Security Controls Tester (Contractor)

Cyberfort; Stone Cross; On-site; GBP 65,000 - 90,000; Part time

Job summary

Cyberfort is seeking an experienced Cyber Security Controls Tester to support a large-scale security assurance programme within a highly regulated environment. You will evaluate the effectiveness of security controls, test against ISO 27001, NIST CSF and NIST 800-53, review policies and configurations, and produce comprehensive assurance reports for stakeholders.

This contract role requires Active SC Clearance and is available for an immediate start through February 2027, with remote UK-based

Qualifications

• Experience testing and evaluating security controls (technical, procedural and physical) in complex environments.
• Strong knowledge of ISO 27001, NIST CSF, NIST 800-53 and CIS Controls.

Responsibilities

• Evaluate effectiveness of security controls to meet design standards and controls catalogues.
• Test controls against ISO 27001, NIST CSF and NIST 800-53.
• Review policies, configurations, IAM, encryption and endpoint security controls.
• Develop and follow testing plans and evidence-based assurance activities.
• Produce assurance reports with findings and remediation recommendations.

Skills

ISO 27001

NIST CSF

NIST 800-53

CIS Controls

GDPR

Job description

Location: Fully Remote (UK)

Contract Type: Contract

Contract Length: Immediate start until February 2027

Security Clearance: Active SC Clearance required and must be verifiable

About The Opportunity

We are seeking an experienced Cyber Security Controls Tester to support a large-scale security assurance programme within a highly regulated environment. This is an excellent opportunity for a contractor with a strong background in security controls testing, assurance and risk management, particularly within central government or wider public sector environments.

What You'll Be Doing

• Evaluating the effectiveness of security controls within the identified environment to ensure they meet the standards defined within supporting documentation, including High-Level Designs (HLDs), Low-Level Designs (LLDs) and Controls Catalogues.

• Testing controls against recognised security frameworks and standards, including ISO 27001, NIST CSF and NIST 800-53.

• Reviewing policies, procedures, network configurations, firewall rules, identity and access management controls, and other technical and procedural security controls.

• Applying recognised controls testing methodologies, including documentation reviews, walkthroughs, sampling and technical verification activities.

• Agreeing testing scope and plans with stakeholders, risk teams and security architects to ensure assurance activity addresses key security concerns.

• Assessing both the design effectiveness and operating effectiveness of implemented security controls.

• Providing pragmatic remediation guidance and recommendations to address identified control weaknesses.

• Supporting improvements to policies, processes and security controls to strengthen the overall security posture of services and environments.

• Maintaining clear documentation of testing activities, evidence collected, findings and remediation recommendations.

• Producing comprehensive assurance reports outlining security posture, findings, risks and recommendations.

• Presenting findings to technical and non-technical stakeholders and agreeing remediation actions where required.

• Working closely with risk and security architecture teams to ensure controls testing supports wider risk management and assurance objectives.

What We're Looking For

You will be a detail-oriented cyber security professional with experience assessing and validating security controls across complex technical environments. You'll be comfortable engaging with both technical and business stakeholders and have the ability to provide clear, evidence-based assurance and practical recommendations.

Essential Skills & Experience

• Demonstrable experience testing and evaluating the effectiveness of technical, procedural and physical security controls within complex environments.

• Strong working knowledge of security control frameworks including ISO 27001, NIST CSF, NIST 800-53 and CIS Controls.

• Experience conducting controls testing, assurance or audit activities against recognised security frameworks.

• Hands-on experience reviewing and testing:

  • Network configurations

  • Firewall rulesets

  • Identity and Access Management (IAM) controls

  • Encryption controls

  • Endpoint security controls

• Familiarity with security design and controls documentation including HLDs, LLDs and Controls Catalogues.

• Experience applying recognised testing methodologies, including documentation reviews, walkthroughs, sampling and evidence-based assurance activities.

• Strong understanding of relevant legislation and compliance requirements, including GDPR, PCI DSS and ICO guidance.

• Working knowledge of HMG and NCSC security policies, standards and guidance.

• Ability to produce clear, well-structured test plans, assurance reports and remediation recommendations.

• Strong stakeholder management and communication skills, with experience engaging risk teams, security architects and business stakeholders.

• Strong analytical and problem-solving skills, with a methodical approach to identifying, evidencing and reporting security control weaknesses.

Desirable Skills & Certifications

• CISA certification.

• ISO 27001 Lead Auditor or Lead Implementer certification.

• CRISC certification.

• CompTIA Security+ or similar security assurance-related certification.

• Experience working within central government or public sector environments.

• Experience supporting governance, risk and compliance (GRC) programmes.

• Exposure to cloud security assurance across Azure and AWS environments.

• Experience supporting IT Health Checks (ITHCs), penetration testing exercises or security accreditation activities.

Please note:

Active SC Clearance is a mandatory requirement for this role and must be current and capable of being validated.