Threat Modelling Engineer - GCP (Senior Associate, Technology)

Publicisgroupe; London; Hybrid; GBP 60,000 - 100,000; Full time

Job summary

An established industry player is seeking a Senior Engineer specializing in Threat Modelling to enhance digital transformation solutions. This role focuses on Security Architecture and Threat Modelling, requiring collaboration with Engineering and Information Security teams. You will conduct technical architecture reviews to identify security opportunities and propose effective mitigation strategies. Join a dynamic team that values creativity and problem-solving, and contribute to impactful projects that drive business success in a supportive and inclusive environment.

Benefits

Hybrid work policy

Inclusive and diverse workforce

Disability confident employer

Flexible working arrangements

Qualifications

• 5+ years in Cybersecurity with experience in threat modeling and security architecture.
• Proficiency in GCP and knowledge of security frameworks and best practices.

Responsibilities

• Conduct threat modeling exercises and manage identified threats and controls.
• Collaborate with cross-functional teams to enhance security measures.

Skills

GCP

Security architecture principles

Threat modeling methodologies

Cybersecurity experience

Authentication and authorization

Infrastructure security

Scripting languages

Technical architecture design

Vulnerability identification

DevOps/agile team experience

Analytical skills

Problem-solving skills

Communication skills

Education

Professional Security Certifications (CISSP, CCSP, etc.)

GCP Professional Cloud Architect certification

Tools

Jira

Terraform

CloudFormation

Docker

Kubernetes

Snowflake

MongoDB

GitHub

Databricks

Job description

Company description

Publicis Sapient is a digital transformation partner helping established organisations get to their future, digitally-enabled state, both in the way they work and the way they serve their customers. We help unlock value through a start-up mindset and modern methods, fusing strategy, consulting and customer experience with agile engineering and problem-solving creativity. United by our core values and our purpose of helping people thrive in the brave pursuit of next, our 20,000+ people in 53 offices around the world combine experience across technology, data sciences, consulting and customer obsession to accelerate our clients’ businesses through designing the products and services their customers truly value.

Overview

As a Senior Engineer - Threat Modelling you will be a part of a smart cross-functional team delivering digital business transformation solutions to our clients. This position entails an individual contributor role focused on Security Architecture and Threat Modelling, encompassing governance, evaluation of public cloud services, and conducting security reviews for Public Cloud Providers. Collaboration and partnership with Engineering, Information Security, Program Management, and Development teams are essential. The candidate will conduct technical architecture reviews to pinpoint security opportunities, identify exploitable threats, and propose mitigation strategies.

Your Impact

• Conduct thorough threat modeling exercises utilizing established methodologies and frameworks.
• Maintain a rigorous standard of excellence in identifying potential threats and specifying effective mitigation controls.
• Manage the lifecycle of identified threats and associated controls, ensuring timely updates and adjustments as necessary.
• Deliver comprehensive threat models and related tasks within specified timeframes.
• Offer constructive feedback, support, and suggestions for enhancing the existing threat modeling process.
• Present findings and progress updates to senior leadership, team members, and relevant technical stakeholders.

Qualifications

Your Skills & Experience

We are seeking an individual with experience in a range of technologies and processes including:

• Proficiency in GCP - essential
• Strong knowledge of security architecture principles, frameworks, and best practices
• Experience working with threat modeling methodologies such as MITRE ATT&CK, STRIDE, PASTA etc.
• Overall experience in Cybersecurity: 5+ years
• Security practices encompassing authentication, authorization, logging/monitoring, encryption, infrastructure security, and network/segmentation
• Knowledge of cloud security frameworks
• Knowledge of Rest API
• Knowledge in scripting languages and Infrastructure as Code (Terraform, CloudFormation)
• Familiarity with Jira or other ticketing systems – essential
• Technical architecture design and review skills – essential
• Ability to identify vulnerabilities using CWE or OWASP
• Knowledge of operating systems and their hardening techniques
• Understanding of development concepts such as CICD, Pipelines, and SDLC
• Penetration testing knowledge is also super useful
• Familiarity with Cloud Development Kit (CDK) and GitOps
• Experience operating in a DevOps/agile team environment
• Understanding of docker, Kubernetes, serverless architecture, and Helm
• Exposure to platforms like Snowflake, MongoDB, Terraform Cloud, GitHub, and Databricks
• Strong analytical skills, diligence, and attention to detail
• Willingness to conduct research using vendor documentation
• Capability to create and maintain high-quality documentation
• Possession of an adversary mindset
• Continuous learning attitude towards new technologies and methodologies
• Strong problem-solving skills
• Excellent communication and collaboration abilities
• Ability to build and nurture relationships across cross-functional teams

Set Yourself Apart With

• Professional Security Certifications: CISSP, CCSP, CISA, CISM, ITIL
• Relevant GCP certifications are highly desirable: GCP Professional Cloud Architect, GCP Professional Cloud Security Engineer.
• Strong knowledge of industry standards as they relate to Cloud and Application security management to include ISO, NIST, and Cloud Security Alliance (CSA)
• Experience working in regulated environments
• Exposure to agile development, DevOps, SecOps and scrum teams
• Hands-on experience with cloud security designs on Azure
• Development experience (python, Node)
• Strong desire to learn and contribute solutions and ideas to broader team

Additional information

Our hybrid work policy requires employees to be present in the office or at client sites for a minimum of 3 days per week (4 days for VP+). We trust our employees to determine what a reasonable commute is for their individual circumstances. Whilst we embrace flexibility, it's essential that this commute allows you to comfortably fulfil the in-office/client site expectations of the policy. We encourage you to consider your personal circumstances and commute when evaluating if this work arrangement is a good fit for you.

As part of our dedication to an inclusive and diverse workforce, Publicis Sapient is committed to Equal Employment Opportunity without regard for race, colour, national origin, ethnicity, gender, age, disability, sexual orientation, gender identity, or religion.

Publicis Sapient UK is a disability confident employer and is dedicated to fostering an inclusive and accessible work environment. We encourage individuals with disabilities and long-term conditions to apply for this position and we will provide adjustments where possible throughout the recruitment process. If you require any adjustments at any point on the process, please get in touch as soon as possible by emailing [e-mail]. Publicis Sapient UK will then work with you to explore and implement adjustments as and where these are possible.

Publicis Sapient fosters an inclusive environment through our inspirational business resource groups, to learn more please visit here.