Security by Design Consultant - SC Cleared

Marks Sattin; Yeovil; Hybrid; GBP 111,000 - 166,000; Full time

Job summary

Marks Sattin is seeking an experienced Security by Design Consultant in Yeovil, Somerset, for a 60-working-day contract between November 2026 and 31 March 2027. The role requires active UK MOD SC clearance and a strong background in defence cyber security, security management, and ISN standards.

The consultant will produce a Security Management Plan, identify security gaps, and design a sequenced remediation plan, working 40% onsite in Yeovil with regular stand-ups and close governance with the

Qualifications

• Minimum seven years' experience delivering cyber security in UK defence.
• Experience producing detailed Security Management Plans.
• Strong knowledge of MOD accreditation and Secure by Design.
• Familiar with Defence Standard 05-138 and ISN 2023/09.
• Active UK MOD SC clearance is required.

Responsibilities

• Produce a comprehensive Security Management Plan covering the programme's systems, services, assets and security perimeter.
• Identify critical and high-priority security gaps affecting service delivery.
• Develop a high-level remediation plan with ownership, timescales, cost and complexity.
• Define system dependencies, external connections and codes of connection.
• Support security governance and risk management across the service lifecycle.
• Build relationships with programme, customer and security stakeholders.
• Transfer security knowledge across the wider programme team.

Skills

Security by Design

MOD SC clearance

Security governance

Defence cyber security

Education

Degree in cyber security / systems engineering / software engineering

Job description

Security by Design Consultant

Location: Yeovil, Somerset, 40% onsite
Contract: 60 working days delivered between November 2026 and 31 March 2027
Clearance: Active UK MOD SC clearance required

We are seeking an experienced Security by Design Consultant to support a major defence aviation programme preparing for the commissioning of an Integrated Logistics Support service.

This is a deliverables-focused engagement requiring approximately 60 working days across the contract period, rather than a full-time assignment. The successful consultant will take ownership of producing a detailed Security Management Plan, identifying critical security gaps and defining a sequenced remediation plan.

Key Responsibilities

• Produce a comprehensive Security Management Plan covering the programme's systems, services, assets and security perimeter.
• Identify critical and high-priority security gaps affecting service delivery.
• Develop a high-level remediation plan covering ownership, timescales, cost and complexity.
• Define system dependencies, external connections and codes of connection.
• Support security governance and risk management across the service lifecycle.
• Build relationships with programme, customer and security stakeholders.
• Transfer security knowledge across the wider programme team.

Essential Experience

• Minimum seven years' experience delivering cyber security outcomes within a UK defence environment.
• Proven experience producing detailed Security Management Plans.
• Strong knowledge of MOD accreditation, assurance and Secure by Design, including ISN 2023/09.
• Experience applying Defence Standard 05-138 Issue 4.
• Knowledge of DEFCON 658, ideally including the latest update.
• Working knowledge of NIST SP 800-30, SP 800-37 and SP 800-53.
• Experience of security governance and risk management within a defence aviation or defence supplier environment.
• Technical understanding of enterprise IT, application security and system security design.
• Ability to operate independently and deliver against a defined Statement of Work.
• Active UK MOD SC clearance.

Qualifications

A degree or master's degree in cyber security, systems engineering, software engineering or equivalent professional experience is preferred.

Candidates should also hold at least one recognised cyber security qualification, such as:

• CISSP
• CISM
• CASP+ / SecurityX
• Chartered Cyber Security Professional, or equivalent

The role requires approximately 40% attendance in Yeovil, alongside at least weekly programme stand-ups.

We're committed to protecting the privacy of all our candidates and clients, please visit https://www.markssattin.co.uk/privacy and https://uk.grafton-recruitment.com/en/privacy-policy-1 for our privacy policy.