Cyber Security Manager - EcliptOS

McKinsey & Company, Inc.; City of Westminster; On-site; GBP 90,000 - 130,000; Full time

Job summary

McKinsey & Company is seeking a senior security professional to own the product security posture across the full lifecycle, translating central policies into product-level controls and maintaining audit-ready documentation. You will lead risk assessments, threat modelling, and secure design decisions while collaborating with product and engineering teams to enforce security standards.

You will promote security awareness, define KPIs and KRIs, and ensure robust incident response and governance

Qualifications

• Bachelor’s degree in related field or equivalent working experience.
• 5+ Years of Cyber Security experience in a similar role.
• Demonstrated ability to apply security by design across architectures and third-party integrations.
• Experience coordinating security risk assessments and threat modelling.
• Ability to interpret central security policies into product-level controls and maintain audit-ready documentation.
• Deep knowledge of access control, logging, encryption, and secure configuration.
• Experience monitoring security events and supporting incident response.
• Ability to collaborate with product managers, engineering leads, SREs, and compliance partners.
• Excellent stakeholder communication and ability to support client activation discussions.

Responsibilities

• Interpret and cascade central security policies into product-specific requirements and controls.
• Own the product’s security posture across design, build, test, release, and operations.
• Maintain and prioritize the product’s security backlog.
• Coordinate risk assessments, threat modelling, and vulnerability assessments.
• Ensure security controls and evidence for third-party integrations.
• Monitor security-relevant events and support incident response efforts.
• Promote security awareness and coach teams on secure development practices.
• Define product-level security KPIs and KRIs.

Skills

Security by design

Threat modelling

Vulnerability assessments

Security risk assessments

Audit-ready documentation

Access control

Logging and monitoring

Encryption

Incident response

KPIs and KRIs

Cross-functional collaboration

Stakeholder communication

Education

Bachelor’s degree in related field or equivalent working experience

Job description

Do you want to do work that matters, alongside supportive leaders who will help you grow faster than you ever thought possible? Are you a creative problem-solver who is energized by challenges? You’ve come to the right place.

YOUR IMPACT

Acting as the primary security point of contact throughout the product lifecycle, you will interpret and cascade central security policies, standards, and regulatory requirements into product-specific requirements, patterns, and controls. You will be responsible for ensuring that a product complies with the firm’s central information and security policies and standards. You will own the product’s security posture across design, build, test, release, and operations, ensuring “security by design and by default” is applied to architectures, technical decisions, and third-party integrations. Your work will involve maintaining and prioritizing the product’s security backlog, coordinating risk assessments, threat modelling, and vulnerability assessments, and ensuring that required security controls (e.g., access control, encryption, secure configuration) are implemented and evidenced. You will monitor security-relevant events, support incident response efforts, and act as the primary point of contact for all product-related security queries. Additionally, you will promote security awareness within the product team, provide best practice guidance to Forward Deployed Engineers, participate in governance forums, and define product-level security KPIs and KRIs.

YOUR GROWTH

You are someone who thrives in a high-performance environment, bringing a growth mindset and entrepreneurial spirit to tackle meaningful challenges that have a real impact. In return for your drive, determination, and curiosity, we’ll provide the resources, mentorship, and opportunities to help you quickly broaden your expertise, grow into a well-rounded professional, and contribute to work that truly makes a difference. When you join us, you will have:

• Continuous learning: Our learning and apprenticeship culture, backed by structured programs, is all about helping you grow while creating an environment where feedback is clear, actionable, and focused on your development. The real magic happens when you take the input from others to heart and embrace the fast-paced learning experience, owning your journey.
• A voice that matters: From day one, we value your ideas and contributions. You’ll make a tangible impact by offering innovative ideas and practical solutions, all while upholding our unwavering commitment to ethics and integrity. We not only encourage diverse perspectives, but they are critical in driving us toward the best possible outcomes.
• Global community: With colleagues across 65+ countries and over 100 different nationalities, our firm’s diversity fuels creativity and helps us come up with the best solutions. Plus, you’ll have the opportunity to learn from exceptional colleagues with diverse backgrounds and experiences.
• Exceptional benefits: On top of a competitive salary (based on your location, experience, and skills), we provide a comprehensive benefits package to enable holistic well-being for you and your family.

YOUR QUALIFICATIONS AND SKILLS

• Bachelor’s degree in related field or equivalent working experience
• 5+ Years of Cyber Security experience in a similar role
• Strong ability to ensure “security by design and by default” across architectures, user stories, technical decisions, and third-party integrations
• Proficiency in coordinating product-level security risk assessments, threat modelling, and vulnerability assessments, as well as maintaining a prioritized security backlog
• Experience interpreting and cascading central security policies, standards, and regulatory requirements into product-specific controls, and ensuring documentation is audit-ready
• Deep knowledge of required security controls, including access control, logging and monitoring, encryption, and secure configuration
• Experience monitoring security-relevant events, managing configuration drift, and supporting incident response efforts (triage, containment, lessons learned)
• Experience participating in risk committees, architecture reviews, and defining/maintaining product-level security KPIs and KRIs
• Ability to collaborate closely with product managers, engineering leads, SREs, and compliance partners, while promoting security awareness and coaching teams on secure development practices
• Excellent communication skills to act as the primary contact for internal stakeholders (architecture, legal, privacy, risk, audit) and external parties, as well as supporting client activation discussions

FOR U.S. APPLICANTS: McKinsey & Company is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by applicable law.

FOR NON-U.S. APPLICANTS: McKinsey & Company is an Equal Opportunity employer. For additional details regarding our global EEO policy and diversity initiatives, please visit our McKinsey Careers and Diversity & Inclusion sites.