Security Analyst

Digi2Al Limited; Plymouth; On-site; GBP 84,000 - 110,000; Full time

Benefits offered by this job

Day rate up to £525

Location: Portsmouth

Initial 6-month contract

Outside IR35

SC clearance

Job summary

Digi2Al Limited, delivering digital solutions for the Royal Navy, seeks a proactive Security Analyst to clear the AGAP backlog under the Secure by Design framework across TLSE and Live Services. You will bridge technical teams and ensure architectural data and security controls are aligned with governance policies.

You will collaborate with TLSE, Live Services, Hosting Services, and Software Developers to gather, verify, and consolidate security data needed to populate each AGAP, maintaining

Qualifications

• 3+ years in information security or application security.
• Practical understanding of SbD concepts, threat modelling, and baselines (OWASP, ISO 27001, NIST).
• Familiarity with SDLC, cloud hosting platforms (AWS/Azure/GCP), and production service operations.
• Excellent stakeholder engagement and ability to translate technical discussions into security documentation.

Responsibilities

• Review and clear the backlog of AGAP assessments across TLSE-owned software products.
• Collaborate with TLSE, Live Services, Hosting Services, the Tech Office, and Developers to gather security data.
• Identify, document and validate product architectures and data flows for SbD alignment.
• Identify gaps, risks, and provide remediation recommendations to stakeholders.
• Maintain audit-ready AGAP documentation and track remediation actions.
• Support governance and reporting of assurance status across the portfolio.

Skills

Info security

App security

Threat modelling

GRC concepts

Stakeholder engagement

Tools

Jira

Confluence

GRC tools

Job description

This Project drives the Royal Navy’s capability by delivering digital solutions that increase operational efficiency, effectiveness, and availability. Operating across Official and Secret domains, from shore to sea.

Data & Navy Application (DNA) provides end-to-end support for bespoke and procured applications.

Security Analyst

We are seeking a proactive and detail-oriented Security Analyst to join our team in a fast-paced software house environment. In this role, your primary focus will be clearing the backlog of Application, Governance and Assurance Pack (AGAPs) required under our Security by Design (SbD) framework for all products owned by TLSE and Live Services.

You will act as the key facilitator and bridge across multiple technical functions; gathering, synthesising, and validating architectural, infrastructure, and operational security data. Your work will ensure that the products across our portfolio are fully documented, assessed, and aligned with security standards and governance policies.

Key Responsibilities

• Systematically review, prioritise, and clear the backlog of AGAP assessments required across the portfolio of TLSE-owned software products.
• Proactively collaborate with TLSE, Live Services, Hosting Services, the Tech Office, and Software Developers to extract, verify, and consolidate technical security data needed to populate each AGAP.
• Identify, assess and document product architectures, data flows and hosting models, validating alignment with established SbD guidance and escalating issues where required.
• Identify missing security controls, unmitigated risks, assurance gaps or architectural concerns and provide recommendations, escalating findings to relevant stakeholders where required.
• Maintain complete, audit-ready AGAP documentation within central security repositories and track remediation actions to completion.
• Gather insights from the review process to provide constructive feedback to the Tech Office on streamlining SbD workflows and AGAP templates.
• Conduct application assurance reviews.
• Analyse existing assurance documentation and evidence.
• Identify gaps against Secure by Design requirements.
• Work with Service Owners, Product Teams and SMEs to discover, capture and document application, infrastructure, security and operational information where existing documentation is incomplete, outdated or unavailable.
• Gather, analyse and organise evidence required to support AGAP completion, assurance reviews and Secure by Design activities.
• Maintain assurance evidence repositories, track remediation actions and support governance and audit activities.
• Document findings, risks and remediation activities.
• Support tracking and reporting of assurance status across the portfolio.

Requirements

• 3+ years in information security, application security analysis, cybersecurity compliance, or IT risk management within a software development or SaaS environment.
• Practical understanding of Security by Design (SbD) concepts, threat modelling principles, and application security baselines (e.g., OWASP, ISO 27001, NIST).
• Familiarity with modern software development lifecycles (SDLC), cloud hosting platforms (AWS, Azure, or GCP), and production service operations.
• Excellent stakeholder engagement skills with the ability to translate technical conversations with developers and engineers into structured security documentation.
• Methodical mindset with sharp attention to detail, capable of dissecting complex software ecosystems and systematically identifying governance gaps.
• Experience of MOD Secure by Design.
• Cyber assurance and risk management.
• Analysis of technical and security documentation.
• Stakeholder engagement and evidence gathering.
• Production of assurance artefacts and supporting documentation.

Nice to haves

• Relevant industry certifications such as Security+, CISSP, CISA, CRISC, or cloud security badges (e.g., AWS Certified Security Specialty).
• Familiarity with Jira, Confluence, or automated GRC tools used for managing security backlogs and risk registers.
• Prior experience working in an Agile/Scrum software house setup.

Benefits

• Start date: Early November
• Day rate: Up to £525 (depending on experience)
• Initial contract length: 6 months (with possible extension)
• Location: Portsmouth
• Minimum security level: SC with no caveats
• Nationality specification: Sole British Citizen (due to Client security requirement)
• Number of days on site: 2-3 days p/w on site, with flex if needed
• Outside IR35