Endpoint & Hardware Platform Security Lead

ByDesign Secure Systems Ltd; West of England; Hybrid; GBP 90,000 - 150,000; Full time

Job summary

ByDesign Secure Systems Ltd is seeking an experienced Endpoint & Hardware Platform Security Lead to drive secure, mission-critical systems in a multi-year transformation for UK government projects. The role emphasizes hardware root-of-trust, endpoint hardening, and cross-team collaboration.

You will operate in a hybrid environment with occasional on-site work in London or Bristol, requiring active UK SC or DV clearance and citizenship.

Qualifications

• 7+ Years in Endpoint Security & Platform Hardware Hardening.
• Hands-on with TPM 2.0, Secure Boot, Windows/Linux/macOS hardening, BitLocker/FileVault/LUKS.
• Experience in highly regulated or classified environments.
• Able to communicate complex security concepts to non-technical stakeholders.
• Proven ability to produce high-quality design documents and runbooks.

Responsibilities

• Establish hardware root-of-trust, platform attestation, and OS baselines.
• Implement hardware security controls (TPM 2.0, Secure Boot, UEFI lockdown).
• Develop Windows, Linux, macOS hardening baselines for endpoints.
• Deploy disk encryption and endpoint security agents across devices.
• Operate in air-gapped and security-sensitive environments with compliance.
• Collaborate with architecture, security and engineering teams.
• Create and maintain High-Level Designs, CLDs, LLDs and runbooks.
• Present designs and plans through governance and Technical Design Authority processes.

Skills

Endpoint Security

Platform Hardening

Hardware Root of Trust

Cross-functional Communication

Technical Documentation

Tools

TPM 2.0

Secure Boot

UEFI Lockdown

Disk Encryption

EDR/EPP Agents

Job description

Endpoint & Hardware Platform Security Lead

This role is delivered within secure environments. Candidates must hold active SC/DV clearance and hold UK citizenship.

Join the Mission

At ByDesign Secure, we believe that world-class security shouldn't be an afterthought—it should be the foundation. We are an independent, outputs-based consultancy dedicated to solving the most complex data assurance challenges in the UK public sector. Currently, we working on a landmark transformation of a cross-government secure IT system. This is an exciting opportunity to help engineer a private cloud environment from the ground up and modernize the end-user services that power national decision-making. We don't believe in "billing by the hour" or rigid hierarchies; we are a lean, expert team focused on delivering high-impact technical outcomes. If you are a self-starter who thrives on autonomy and wants to see your engineering or architectural decisions shape the future of sovereign security, we want to talk to you.

About the Opportunity

Are you an Endpoint & Hardware Platform Security Lead with a passion for engineering secure, mission-critical systems?

We’re looking for an experienced Endpoint & Hardware Platform Security Lead to join our team. You’ll be part of a multi-year transformation programme, shaping and implementing some of the most strategically significant government systems in operation today.

What You’ll Be Doing

• Platform security lead establishing hardware root-of-trust, platform attestation, and multi-OS endpoint security baselines.
• Implement hardware platform security controls including TPM 2.0, Secure Boot, UEFI lock-down, and hardware attestation.
• Formulate security hardening baselines for Windows, Linux, and macOS client endpoints.
• Deploy disk encryption, local EDR, and endpoint DLP agents across physical laptops and desktops. Provide support to a model office environment where we will have the capability to demonstrate capabilities to our end users to facilitate rapid feedback.
• Operate and maintain solutions within disconnected, air-gapped, and security-sensitive environments, ensuring compliance with organisational security requirements.
• Collaborate with architecture, security, and engineering teams to deliver solutions aligned with enterprise standards and best practices.
• Develop and maintain technical documentation, including High-Level Designs (HLDs), Component-Level Designs (CLDs), Low-Level Designs (LLDs), operational procedures, and support runbooks.
• Produce and present technical designs, implementation plans, and service improvements through governance and Technical Design Authority (TDA) processes as required.

What You’ll Bring

• 7+ Years Endpoint Security & Platform Hardware Hardening.
• Practical hands-on knowledge of key technologies including: TPM 2.0, Secure Boot, Windows / Linux / macOS Hardening, BitLocker / FileVault / LUKS, EDR / EPM Agents.
• Experience working in environments without direct internet connectivity.
• Confident working within highly regulated or classified environments where reliability and compliance are paramount.
• Strong communicator — able to bridge technical and non-technical stakeholders effectively.
• Good standard of written communication to enable high-quality design outputs to be produced.

Bonus Points For

• Prior experience working on government classified systems or within secure data centre environments.
• Experience of configuring and using AI technologies within cloud environments.
• Familiarity with NCSC guidance, UK Government cloud policies, or cross-domain architectures.
• Cloud Certifications.
• Existing DV clearance.

Why This Role?

Work on high-impact, nationally significant projects that make a real difference.

Join a trusted specialist integrator with a proven record of secure delivery into UK Government.

Be part of a multi-year programme offering long-term stability and genuine career growth.

Clearance Requirements:

This role requires either an existing Security Clearance (SC level) or for one to be passed before commencement. There must be a willingness to undergo Developed Vetting (DV).

Work Location:

Hybrid remote in London / Bristol

Job Types:

Temporary, Fixed term contract (outside of IR35)

Screener Questions:

• Do you hold UK nationality? (Required due to client security restrictions)
• Do you currently hold active UK SC clearance?
• Are you eligible and willing to undergo UK SC/DV clearance for this role? (Applications without this cannot be considered)
• Does your delivery approach allow for on-site presence in London or Bristol when required (typically 3 days per week)?