Security Engineering Consultant

Sanderson; Greater London; Hybrid; GBP 101,000 - 120,000; Full time

Job summary

Sanderson in the United Kingdom is seeking an experienced Security Engineer/Consultant on a contract basis to embed within engineering tribes. The role focuses on threat modelling and guidance across the SDLC to ensure secure by design products.

You will conduct threat models for new and existing products and help developers mitigate threats during development. The contract runs for an initial 6 months with an outside IR35 rate of £550–£650 per day and a location mix of Bristol or London (with

Qualifications

• Significant threat modelling experience with IriusRisk or similar tools.
• Deep knowledge of OWASP standards and web application security.
• Experience with DevSecOps and CI/CD security integration.
• Familiar with secure SDLC in agile environments.
• Experience in vulnerability management.
• Ability to communicate security risks to technical and non-technical stakeholders.

Responsibilities

• Conduct and document threat models across products and services, from initial design through to delivery.
• Work with development teams to mitigate identified threats during development.
• Provide security consultancy and guidance to engineers, product owners and architects.
• Embed secure development practices across the SDLC and support the adoption of DevSecOps.
• Support application security activities, including secure design reviews and security testing.
• Manage and improve vulnerability management processes, supporting teams with prioritisation and remediation.
• Produce threat modelling diagrams and supporting documentation for use by delivery teams.
• Support the development of security knowledge within engineering teams.

Skills

Threat modelling

Application security

DevSecOps

Secure SDLC

Vulnerability management

Communication

Tools

IriusRisk

Kubernetes

Job description

Security Engineer / Security Consultant (Application Security & Threat Modelling)

Rate - £550 - £650 Outside IR35
Duration - 6 months initial
Location - Bristol / London (once a week / remote)

Role overview

A leading Financial Services is seeking an experienced Security Engineering Consultant on a contract basis. The successful candidate will be embedded within engineering tribes, providing security consultancy and guidance to development teams throughout the software development lifecycle.

The primary focus of the role is threat modelling. The consultant will conduct threat models for new and existing products, identify risks at the design stage and work with developers to mitigate those threats during development, ensuring that products are secure by design.

Key responsibilities

• Conduct and document threat models across products and services, from initial design through to delivery
• Work with development teams to mitigate identified threats during development
• Provide security consultancy and guidance to engineers, product owners and architects
• Embed secure development practices across the SDLC and support the adoption of DevSecOps
• Support application security activities, including secure design reviews and security testing
• Manage and improve vulnerability management processes, supporting teams with prioritisation and remediation
• Produce threat modelling diagrams and supporting documentation for use by delivery teams
• Support the development of security knowledge within engineering teams

Essential requirements

• Significant experience in threat modelling - experience using IriusRisk or comparable threat modelling tools
• Experience in application security, with detailed knowledge of OWASP standards and web application security
• Experience of DevSecOps practices, including integrating security controls into CI/CD pipelines
• Knowledge of the secure SDLC within agile delivery environments
• Experience of vulnerability management
• Working knowledge of Kubernetes and container security
• The ability to communicate security risks clearly to technical and non-technical stakeholders

Reasonable Adjustments

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.