Cybersecurity Governance & Assurance Specialist

Amaris Consulting; Greater London; On-site; GBP 60,000 - 80,000; Full time

Benefits offered by this job

Strong training system

Dynamic work environment

International community

Job summary

Amaris Consulting in the UK is seeking a Cybersecurity Governance & Assurance Specialist to enhance cybersecurity practices for key clients in off-highway machinery. The role demands a candidate with at least 3 years of experience and significant knowledge of ISO/SAE standards.

The successful applicant will be responsible for governance frameworks, compliance assessments, and vulnerability management, while fostering a collaborative environment.

Join us for an inclusive workplace that values diverse perspectives and continuous learning.

Qualifications

• 3+ years of experience in a cybersecurity role within Tier 1 or OEM sectors.
• Demonstrable experience in cybersecurity governance and compliance assessment.
• Strong working knowledge of ISO/SAE 21434 and ISO 24882.

Responsibilities

• Own and maintain the cybersecurity governance and assurance framework.
• Plan and execute cybersecurity compliance assessments.
• Define cybersecurity testing expectations for compliance evidence.

Skills

Cybersecurity assurance

Governance and compliance

Technical writing

Stakeholder management

ISO/SAE 21434

Job description

Cybersecurity Governance & Assurance Specialist – Amaris Consulting UK

Amaris Consulting UK is looking for a talented and driven Cybersecurity Governance & Assurance Specialist to join our team and support one of our key clients in the off‑highway machinery sector.

Your Missions

Governance and Standards

• Own and maintain the product cybersecurity governance and assurance framework, aligned with the broader compliance model used across disciplines
• Develop and maintain internal standards, templates, checklists, and guidance to enable consistent execution across programmes (e.g., System of Interest definitions, TARA guidance, cybersecurity requirements, testing expectations, and evidence packs)
• Create and deliver training and enablement programmes to uplift engineering teams and drive "right first time" compliance

Programme Compliance Assessment and Assurance

• Plan and execute cybersecurity compliance assessments of product programmes and suppliers, reporting status, risks, and evidence gaps clearly and early
• Assess alignment against internal requirements and relevant external standards and regulations, including ISO/SAE 21434, ISO 24882, IEC 62443, and the Cyber Resilience Act (CRA)
• Review the adequacy of key cybersecurity work products such as threat modelling/TARA outputs, requirements, architecture evidence, verification and validation strategies, and residual risk statements
• Drive closure of findings with stakeholders across systems, embedded software, verification, manufacturing/service, and suppliers

Cybersecurity Testing Assurance

• Define cybersecurity testing expectations required for compliance evidence, covering coverage scope, methods, reporting, and remediation tracking
• Coordinate Red Team and testing activities to ensure outputs support programme assurance and close testing capability gaps

Vulnerability Management and Post‑Production Assurance

• Establish and assure governance for post‑production vulnerability management, including monitoring from suppliers, research findings, Red Team outputs, and PSIRT channels, and routing to affected products
• Support readiness for CRA mandatory reporting, including Article 14 reporting workflows and fast‑track response for actively exploitable issues
• Capture and disseminate lessons learned (e.g., CWE/CVE insights) back into standards, checklists, and training materials

Your Profile

• 3+ years of experience within Tier 1 or OEM sectors (on‑highway or off‑highway) in a cybersecurity role
• Demonstrable experience in product cybersecurity assurance, governance, compliance assessment, or cybersecurity audit for embedded or cyber‑physical products
• Strong working knowledge of ISO/SAE 21434 and ISO 24882, with the ability to translate them into practical internal processes and evidence expectations
• Working knowledge of IEC 62443 and supplier assurance requirements
• Familiarity with CRA compliance needs, including defined reporting workflows such as Article 14
• Excellent technical writing, communication, and stakeholder management skills, with the ability to present risk clearly and pragmatically
• Knowledge or experience of TARA and threat modelling approaches, including review of threat artefacts such as attack trees, is a plus
• Background in vulnerability management and post‑production monitoring/triage governance is a plus
• Experience in cybersecurity requirements engineering and cybersecurity testing (including test evidence expectations) is a plus
• Awareness of functional safety interfaces and the security‑safety relationship is a plus
• Understanding of embedded product environments including ECUs, CAN, J1939, and diagnostics such as UDS is a plus
• Familiarity with SBOM concepts and their role in vulnerability monitoring and compliance evidence is a plus
• Self‑motivated, analytical, and pragmatic, with strong interpersonal skills and a collaborative mindset
• Resilient and adaptable, with a drive for continuous improvement and a high standard of technical delivery

Why choose us

• An international community bringing together more than 110 different nationalities
• An environment where trust is central: 70% of our leaders started their careers at the entry level
• A strong training system with our internal Academy and more than 250 modules available
• A dynamic work environment that frequently comes together for internal events (afterworks, team buildings, etc.)

Amaris Consulting promotes equal opportunities. We are committed to bringing together people from diverse backgrounds and creating an inclusive work environment. In this regard, we welcome applications from all qualified individuals, regardless of sex, sexual orientation, race, ethnicity, beliefs, age, marital status, disability, or other characteristics.