Security Consultant - FTC

M&G plc; Stirling; On-site; GBP 70,000 - 100,000; Full time

Benefits offered by this job

Flexible working arrangements

Workplace adjustments

Job summary

M&G plc is seeking a Security Consultant to lead security design reviews and translate complex threats into clear requirements across cloud, mobile and web platforms.

You will work with IT, security engineers and business partners to embed security early in change initiatives, delivering actionable guidance, risk assessments and governance across multiple projects.

Qualifications

• A good understanding of Azure security is essential and Azure AD experience would be advantageous.
• Experience designing secure systems across cloud, on-premises and hybrid environments.
• Ability to translate complex security requirements into clear, actionable guidance.

Responsibilities

• Ensure security designs comply with controls and remediate gaps with platform teams.
• Assess implications of control gaps with risk and tech teams.
• Provide security guidance across initiatives, interacting with senior stakeholders.

Skills

Stakeholder management

Security architecture

Threat modeling

Azure security

Communication

Education

Bachelor's degree in a security or IT field

Tools

Azure Security Center

Azure AD

Job description

At M&G, our purpose is to give everyone real confidence to put their money to work. With a heritage dating back more than 175 years, we have a long history of innovation in savings and investments, combining asset management and insurance expertise to offer a wide range of solutions.

Our two distinct operating segments, Asset Management and Life, work together to provide access to balanced, long-term investment and savings solutions.

Through telling it like it is, owning it now and moving it forward together with care and integrity; we are creating an exceptional place to work for exceptional talent.

We will consider flexible working arrangements for any of our roles and offer workplace adjustments to ensure you have the support you need to succeed in your role.

The Security Consultancy (SecCon) team are information technology specialists at the forefront of ensuring our technology change initiatives are delivered securely. We need leaders who are technical security experts and are confident dealing with a range of stakeholders from IT, the business, and strategic partners. You will be working on exciting new change initiatives, helping security and our business partners to achieve the digital ambitions across web, mobile and cloud.

As a Security Consultant within M&G you'll have the opportunity to lead change, working on a wide range of different projects & platforms, translating best practice into high level security requirements, researching modern technologies to assess designs for implementation, and explaining threats and vulnerabilities to stakeholders in support of risk management. You'll also be working closely with our security engineers to understand and develop the enterprise's security architecture and integrate them into change initiatives.

Primary Key Responsibilities

• Ensuring technical and solution designs are compliant with our controls, be able to articulate a position on the security of the design and work with platform teams to remediate any gaps.
• Working with 1st line risk and technology teams to assess the implications of any control gaps which cannot be remediated
• Act as the entry point for Security and provide security advice and guidance, including identifying and assessing security threats, vulnerabilities, and risks for all change and BAU initiatives
• Representing enterprise security at technical design authorities to ensure solutions presented meet security best practice. Working any highlighted issues to resolution.
• Work with different areas in enterprise security to reduce friction and apply necessary security integrations for new technologies and ensure Security is embedded in solutions as early as possible.

Additional Responsibilities

• Remain current with emerging security technologies and feed into strategic technology discussions.
• Tailor and present complex data to different stakeholders.
• Provide security advice and guidance to technology programs, third party integrations, supply chain engagements and longer term projects.
• Focus on future developments, technologies and regulations which could affect the firm or our partners, and the impact they could have on our controls
• Excellent written and verbal communication with technical and non-technical stakeholders, IT teams, and external partners.
• Key involvement in technical design governance process. Must be able to tell it how it is in front of senior stakeholders.
• Provide guidance and support during the implementation of security measures and technologies
• Prepare comprehensive reports and documentation detailing findings, recommendations, and action plans
• Analyse security risks and develop risk management strategies as required
• Assist in creating and updating security policies, standards, and procedures to ensure control compliance and best practices as required

Key Stakeholders Management

Internal

• Business and technology stakeholders at all levels

External

• External vendors (Where required)

Knowledge

• A good understanding of Azure security is essential and M365 / Microsoft Power Platform security capabilities would be an advantage.
• An excellent understanding of securing applications, infrastructure and networks. This includes a detailed understanding of security technologies required to secure an enterprise, their capabilities and interoperability covering:
• Cyber / Web Security (Firewalls, DoS, Proxies, CDN / WAF, API Gateways etc.).
• Threat & Incident Management (SOC, SIEM, Threat Intelligence, etc)
• Data Security (DLP, DRM, etc)
• IDAM (FIAM, SSO, etc). Experience of Azure AD would be advantageous.
• Mobile Security (EMM, MAM, MDM etc).
• Cryptography (including Key Management and PKI)
• Desktop / Server / Virtualisation Security (vulnerability and patch management, malware protection, etc)
• Working knowledge of infrastructure and application security requirements
• Detailed working knowledge of infrastructure and application security requirements, demonstrated through understanding of recognised information security management and governance frameworks such as, ISF Standards of Good Practice, NIST 800-53 or CIS 7.1. An understanding of the regulations and legislation that apply to a pension and investment organisation would be advantageous

Skills

• Strong stakeholder management skills.
• Highly organised, excellent prioritisation and planning skills
• Confident and effective communicator (both written and verbal) across all levels of the organisation to influence using risk-based reasoning.
• Extensive experience in articulating complex requirements as easy to understand security designs using threat profiling, reusable models and architecture principles
• Ability to work alone or as part of a team, whilst working on multiple items at the same time.
• Ability to work with limited supervision, seeking guidance where appropriate.
• Ability to translate complex technical issues into meaningful details for non-specialist audiences.
• Ability to understand organisational culture and use this knowledge to gain commitment and get work done.
• Strong facilitation skills to elicit information from key stakeholders internally and externally.
• Creative thinking to contribute to the overall solution design.
(truncated)