Senior Cyber Security Consultant

Aon plc; Greater London; On-site; GBP 110,000 - 150,000; Full time

Job summary

Aon plc in London is seeking a Senior Cyber Security Consultant to apply an attacker’s mindset in an advisory setting, focusing on cyber due diligence and risk assessment for private equity and corporate clients. The role blends technical review with executive‑level communication in a fast‑paced, client‑facing environment.

Ideal candidates bring offensive security experience and a desire to translate complex findings into actionable risk mitigation and value for investors and management teams.

Qualifications

• Experience in red teaming or offensive security gained in consultancy, in‑house or government settings.
• Understanding attacker techniques and how to apply them in advisory risk contexts.
• Ability to communicate complex security concepts to non‑technical stakeholders.

Responsibilities

• Lead technical cyber security reviews as part of cyber due diligence and portfolio engagements.
• Assess client environments from an adversary perspective to identify realistic attack paths.
• Review external attack surface and internet-facing exposure using passive techniques and threat intel.
• Evaluate security controls against attacker techniques mapped to MITRE ATT&CK.
• Translate technical findings into prioritized risks, remediation roadmaps and investor‑facing guidance.
• Produce high‑quality reports and executive briefings for clients.

Skills

Red teaming

Penetration testing

Adversary simulation

Cyber risk assessment

Job description

We’re hiring!

Aon is seeking a Senior Cyber Security Consultant to join our Digital M&A Advisory practice in London.

The team advises private equity investors, infrastructure funds and corporate clients on technology, IT, cyber and digital risks across acquisitions, portfolio companies and strategic transformation initiatives. Our work spans cyber due diligence, technical cyber reviews, cyber risk assessments, separation and integration support, and post-transaction cyber value creation.

This role is ideally suited to a technically strong security professional with a background in red teaming, penetration testing or offensive security who wants to apply an attacker’s mindset in an advisory setting. This is not a red teaming role: rather than carrying out offensive operations, you will use your understanding of how real-world attackers think and operate to assess client environments, identify the exposures that matter most, and explain cyber risk in terms investors and executives can act on. Previous M&A experience is not required.

You will bring an adversarial perspective to our engagements, working directly with investors, CISOs, technology teams and C‑suite executives to resolve how an organisation could realistically be compromised, what the business impact would be, and what should be prioritised to reduce risk.

This is a fast-paced, client‑facing role offering significant exposure to a broad range of industries, environments and technologies, and a clear path for offensive security professionals looking to move into strategic, consultative work.

About Aon

Headquartered in London, Aon Plc is a leading global professional services firm providing a broad range of risk, retirement and health solutions. Our 50,000 colleagues in 120 countries empower results for clients by using proprietary data and analytics to deliver insights that reduce volatility and improve performance.

Aon is an equal opportunities employer. Aon's recruitment and selection policy ensures the best possible skill mix of colleagues and the highest quality candidates are appointed using objective job‑related criteria.

About the Role

Your impact as a Senior Cyber Security Consultant:

You will be responsible for bringing an attacker‑informed perspective to engagements across private equity and corporate clients, including:

• Leading technical cyber security reviews as part of cyber due diligence, technical review and portfolio company engagements.
• Assessing client environments from an adversary’s perspective, identifying realistic attack paths across identity, network, cloud, endpoint and application layers to critical business assets.
• Reviewing external attack surface and internet‑facing exposure, using passive and non‑intrusive reconnaissance techniques and threat intelligence.
• Evaluating the effectiveness of security controls (e.g. EDR, MFA, segmentation, privileged access, logging and detection) against known attacker tactics, techniques and procedures, mapped to MITRE ATT&CK.
• Interpreting and challenging the results of client penetration tests, red team exercises and vulnerability assessments, assessing scope, quality, remediation status and residual risk.
• Assessing detection and response maturity, including SOC capability, alerting coverage and incident response readiness against realistic threat scenarios.
• Developing threat‑led risk scenarios (e.g. ransomware, data exfiltration, supply chain compromise) tailored to a client’s sector and business model.
• Advising on the scoping and procurement of offensive security testing for portfolio companies, and helping clients get value from those exercises.
• Translating technical findings into prioritised, commercially relevant risks, remediation roadmaps and cost estimates for investors and management teams.
• Producing high‑quality reports, presentations and executive briefings.
• Managing technical workstreams and supporting engagement delivery across multiple concurrent projects.
• Working closely with colleagues across technology, cyber, M&A and risk advisory disciplines, and acting as a technical sounding board for the wider team.
• Contributing to the development of the team's technical review methodologies, threat‑led assessment approaches and market offerings.
• Supporting client engagements across the UK and EMEA.

About you

Your knowledge and expertise:

Technical

• Demonstrable experience in red teaming, penetration testing, adversary simulation or offensive security, gained in a consultancy, in‑house or government setting.
• A strong, practical understanding of how attackers gain initial access, elevate privileges, move laterally and achieve their objectives in enterprise environments.
• A genuine interest in moving from hands‑on testing into advisory, risk‑focused and client‑facing work.
• Offensive experience across one or more of the following:
• Active Directory and Entra ID attack techniques
• Infrastructure and internal network testing
• Cloud security testing (Azure, AWS and/or Google Cloud)
• External attack surface and perimeter testing
• Web application and API security
• Social engineering and phishing simulation
• Endpoint and EDR evasion techniques
• OT/ICS security testing
• Familiarity with one or more of the following frameworks and methodologies:
• MITRE ATT&CK
• CBEST, TIBER-EU and/or STAR-FS threat intelligence‑led testing frameworks
• CHECK and CREST testing standards
• NIST CSF
• CIS Critical Security Controls
• ISO 27001
• Understanding of defensive controls and security operations, and the ability to assess their real‑world effectiveness against attacker behaviour.
• Ability to quickly understand unfamiliar environments and identify the exposures that most matter to the business.
• Experience identifying and assessing cyber risks within sophisticated environments, with the ability to communicate technical findings and business implications to both technical and non‑technical stakeholders.
• Strong analytical and problem‑solving skills.
• Commercial awareness and the ability to understand business implications of technology and security decisions.
• Excellent written and verbal communication skills with the ability to convey sophisticated technical concepts to non‑technical audiences.

Team & Client Management

• Experience managing technical workstreams and contributing to successful project delivery.
• Strong stakeholder management and presentation skills.
• Ability to engage effectively with both technical teams and senior business executives.
• Experience developing positive client relationships.
• Comfortable working within multidisciplinary and global teams and fast‑paced consulting environments.
• Ability to manage multiple engagements and competing priorities.
• Highly organised with strong attention to detail and quality.

Highly Desirable

• Experience scoping, leading or quality‑assuring red team or penetration testing engagements.
• Exposure to attack path analysis, exposure management or cyber risk quantification platforms.
• Experience in threat intelligence, purple teaming or detection engineering.
• Experience writing executive‑level reports or debriefing senior stakeholders on testing outcomes.
• Industry‑recognised certifications, such as:
• CREST CCT Inf / CCT App / CCSAS / CCSAM
• OSCP / OSEP / OSCE3
• CRTO / CRTL
• GIAC GPEN / GXPN
• CHECK Team Leader or Team Member
• CISSP
• Experience working with private equity‑backed businesses or large corporate organisations.
• Experience mentoring junior team members or supporting team development initiatives.
• Interest in business development and market‑facing activities. Experience or interest in line management.
• Interest in supporting client relationship management.

What Success Looks Like

• Delivering high‑quality, technically robust, threat‑informed cyber reviews for private equity and corporate clients.
• Acting as the go‑to adversarial perspective across engagements.
• Building trusted relationships with client technology, security and business stakeholders.
• Providing insightful, commercially relevant recommendations that support investment and operational decision‑making.
• Contributing to the growth and development of the Digital M&A Advisory practice and its technical capabilities.
• Supporting the development of junior colleagues and enhancing team capabilities.