Information Security Engineer - Classified Systems

Lockheed Martin; Frome, Ampthill; On-site; GBP 65,000 - 90,000; Full time

Job summary

Lockheed Martin is seeking an Information Security Engineer to lead security engineering, accreditation, and lifecycle assurance of classified IT systems in the UK. You will work with programme teams and accreditors to embed security throughout the system lifecycle.

The role requires expertise in Secure by Design, risk assessment, and authority to operate (ATO) processes, with a focus on regulatory and customer security requirements in defence environments.

Qualifications

• Experience securing classified or highly regulated IT environments.
• Knowledge of cloud security principles including AWS, IaaS, and PaaS.
• Experience in security architecture reviews, threat modelling, and risk assessments.
• Familiarity with Secure by Design principles in complex IT systems.
• Ability to communicate security concepts to technical and non-technical stakeholders.
• Experience with accreditation processes and RMADS/ATO documentation.

Responsibilities

• Lead Secure by Design across classified IT systems.
• Provide security engineering throughout SDLC and operational lifecycle.
• Conduct security architecture reviews, threat assessments, and risk analyses for classified environments.
• Develop and maintain system security documentation, security architectures, and SOPs.
• Lead and coordinate system accreditation activities for classified and sensitive systems.
• Develop and maintain accreditation artefacts including RMADS and Security Cases.
• Work with Accreditors, Security Controllers, and customer security representatives to obtain/maintain ATO approvals.
• Ensure continued compliance with regulatory, contractual, and customer security requirements.
• Identify, assess, and mitigate cybersecurity risks within classified IT environments.
• Conduct security assessments, vulnerability reviews, and audits against standards.
• Support risk treatment and remediation activities.
• Ensure alignment with SPF/NCSC/JSP/NIST and Lockheed Martin policies.
• Support incident response investigations affecting classified systems.
• Assist with vulnerability management, patch management, and security monitoring.
• Participate in security reviews and investigations to identify root causes.
• Provide technical guidance to admins and engineering teams on security controls.
• Collaborate with programme managers and customer representatives.
• Provide security guidance during design, implementation, and operations.

Skills

Windows Server

Linux

Virtualization

Enterprise networking

Secure by Design

Threat modelling

Security testing

Risk assessment

Education

Cyber Security degree

Computer Science degree

Engineering degree

Job description

About The Role

Reporting to the EMEA Information Security Officer, the Information Security Engineer will be responsible for the security engineering, accreditation, and lifecycle assurance of classified and sensitive IT systems. The role will support the design, implementation, operation, and continuous improvement of secure IT environments, ensuring compliance with UK Government, MoD, and Lockheed Martin security requirements. The successful candidate will work closely with programme teams, architects, infrastructure engineers, accrediting authorities, and information assurance stakeholders to ensure security is embedded throughout the system lifecycle.

Key Responsibilities

• Lead the implementation of Secure by Design principles across classified IT systems and projects.
• Provide security engineering expertise throughout the system development and operational lifecycle, ensuring security requirements are identified and implemented from concept through disposal.
• Conduct security architecture reviews, threat assessments, and technical risk analysis for classified environments.
• Support the development and maintenance of system security documentation, security architectures, and security operating procedures.
• Lead and coordinate system accreditation activities for classified and sensitive systems.
• Develop and maintain accreditation artefacts including Risk Management and Accreditation Documentation Sets (RMADS), Security Cases, Security Management Plans, and supporting evidence.
• Work with Accreditors, Security Controllers, and customer security representatives to obtain and maintain Authority to Operate (ATO) approvals.
• Ensure continued compliance with applicable regulatory, contractual, and customer security requirements throughout system operation.
• Identify, assess, and mitigate cybersecurity risks within classified IT environments.
• Conduct security assessments, vulnerability reviews, and compliance audits against corporate and government security standards.
• Support risk treatment planning and remediation activities.
• Ensure alignment with NCSC, MoD, JSP, NIST, and Lockheed Martin security policies and standards where applicable.
• Support incident response investigations affecting classified systems.
• Assist with vulnerability management, patch management, and security monitoring activities.
• Participate in security reviews and technical investigations to identify root causes and corrective actions.
• Provide technical guidance to system administrators and engineering teams on security controls and best practices.
• Collaborate with programme managers, solution architects, IT teams, information assurance practitioners, and customer representatives.
• Provide security guidance to project teams during system design, implementation, and operational support phases.
• Support customer and regulatory audits and inspections.

Required Skills, Qualifications And Experience

• Strong understanding of Microsoft Windows Server, Linux operating systems, virtualisation technologies, and enterprise networking.
• Experience securing classified, air-gapped, or highly regulated IT environments.
• Knowledge of cloud security principles including AWS, IaaS, and PaaS technologies where applicable.
• Familiarity with security technologies including endpoint protection, SIEM, vulnerability management, encryption, and identity management solutions
• Demonstrable experience applying Secure by Design principles in complex IT systems and programmes.
• Experience conducting security architecture reviews, threat modelling, and risk assessments.
• Strong understanding of system hardening, security controls implementation, and security testing methodologies.
• Experience supporting system engineering and security requirements management within regulated environments.

Accreditation & ATO Experience

• Proven experience developing accreditation evidence and security assurance documentation.
• Experience obtaining and maintaining Authority to Operate (ATO) approvals for classified or regulated systems.
• Knowledge of UK Government and MoD accreditation processes and assurance frameworks.
• Experience working directly with accrediting authorities, security controllers, or customer assurance organisations.
• Excellent written and verbal communication skills.
• Ability to communicate technical security concepts to both technical and non-technical stakeholders.
• Strong analytical and problem-solving skills.
• Ability to work independently while supporting multiple programmes and stakeholders.
• CISSP, CISM, or equivalent Information Assurance certification.
• Degree in Cyber Security, Information Security, Computer Science, Engineering, or a related discipline.
• Experience within Defence, Aerospace, Government, or National Security sectors.

Additional Requirements

• Knowledge of UK Government Security Policy Framework (SPF), NCSC guidance, JSP 440, and Defence security requirements.
• Understanding of GDPR and UK Data Protection Act requirements where applicable.
• Ability to obtain and maintain UK Security Check (SC) clearance with willingness and eligibility to achieve Developed Vetting (DV) clearance.
• Occasional UK and EMEA travel may be required.