Threat Modeling – Cyber Security

Dianaduggan; Greater London; Hybrid; GBP 83,000 - 92,000; Full time

Job summary

Big Four client is seeking Threat Modelling Associates to join our security team in London. Hybrid role: four days in-office, one day remote. 6-month contract with potential extension. Day rate £450–£500 inside IR35 via umbrella.

Responsibilities include threat modeling with a documented process, development of automation tools, and maintaining high standards in identifying threats and mitigating controls.

You will train and supervise junior members and help deliver the threat model service.

Qualifications

• Experience in Cyber-Security/Information Security is essential.
• Threat Modelling using STRIDE, PASTA, Attack trees and ATT&CK.
• Security practices for authentication, authorization, logging/monitoring, encryption, infrastructure security, and network segmentation.
• Knowledge of CI/CD, Pipelines, SDLC concepts.
• Familiarity with Infrastructure as Code (Terraform, CloudFormation).
• Understanding of Docker, Kubernetes, Serverless, and Helm.
• Strong programming skills in Python (async) and FastAPI.
• Experience with Pytest for unit testing.
• Ensure software platforms adhere to security standards and SDLC processes.

Responsibilities

• Threat Modelling using a documented process.
• Develop automation tools as required.
• Maintain a high standard of work in identifying threats and specifying mitigations.
• Attend to the lifecycle of identified threats and controls.
• Deliver threat models and supporting tasks within timeframes.
• Provide feedback, support, and improvements to the threat modelling process.
• Train newer team members and supervise juniors.
• Run parts of the threat model service.
• Work with minimal supervision to complete tasks.
• Develop, test, and deploy secure Python-based applications following SDLC.

Skills

Threat Modeling

Python

FastAPI

Unit Testing

CI/CD

Terraform

CloudFormation

Docker/K8s

Security SDLC

Async programming

Tools

Terraform

CloudFormation

Docker

Kubernetes

Pytest

FastAPI

AWS

GCP

Azure

Python

Job description

We are recruiting Threat Modelling Associates to join our client, one of the Big Four.

You will be responsible for mapping systems, anticipate threats, prioritize risks and design defences.

• Role: Threat Modeling
• Contract duration: 6 months initially (with scope to extend)
• Location: Hybrid – 4 days a week in London office, 1 day working from home.

We are recruiting Threat Modelling Associates to join our client, one of the Big Four.

You will be responsible for mapping systems, anticipate threats, prioritize risks and design defences.

• Role: Threat Modeling
• Day rate: £450 – 500 per day (inside IR35)
• Pay framework: Umbrella Company
• Start date: ASAP
• Contract duration: 6 months initially (with scope to extend)
• Location: Hybrid – 4 days a week in London office, 1 day working from home.

Key Responsibilities

• Threat Modeling using a documented process.
• Development of automation tools as required.
• Maintain a high standard of work in identifying threats and specifying mitigating controls.
• Attending to the lifecycle of identified threats and controls.
• Delivery of threat models and supporting tasks within existing timeframes.
• Provide feedback, support, and improvements to the existing threat modeling process.
• Train newer members of the team
• Supervise junior members of the team
• Run parts of our threat model service
• Work with little supervision to complete work
• Develop, test, and deploy secure and efficient Python-based applications, adhering to established SDLC processes and quality standards.

Certification Requirements

• You must have a cloud certification and from either AWS, GCP or Azure.
• You must have cloud security certification from either AWS, GCP or Azure.
• You must have a cyber-security certification

Essential experience

• Experience working in Cyber-Security/Information Security – must
• Threat Modelling (STRIDE, PASTA, Attack trees, tooling, Att&ck)
• Experience in security practices pertaining to authentication, authorization, logging/monitoring, encryption, infrastructure security, network/segmentation
• Development concepts (such as: CICD, Pipelines, SDLC)
• Scripting languages, Infrastructure as Code (Terraform, CloudFormation)
• Understanding of docker/K8S/serverless/helm – must.
• Strong proficiency in Programming Languages, with a preference for Python (asynchronous programming), and FastAPI
• Unit Testing: Developing and executing unit tests using frameworks like Pytest to ensure code quality
• Ensure all software platforms adhere to security standards and Software Development Life Cycle (SDLC) processes