Cyber Security Consultant

Investigo; United States; Remote; GBP 55,000 - 66,000; Full time

Benefits offered by this job

Remote work

Job summary

Investigo is seeking a Security Analyst / Security Consultant to embed security across development teams in a remote UK role. You’ll own app security, threat modelling, and CI/CD security, ensuring secure-by-design practices in Azure and AWS environments.

You’ll translate technical risk for non-technical stakeholders and drive DevSecOps adoption, with focus on risk-aware, scalable security controls across containers, APIs, and infrastructure.

Qualifications

• Experience securing cloud environments (Azure, AWS).
• Familiarity with secure development lifecycle and DevSecOps practices.
• Knowledge of OWASP Top 10 and secure coding principles.
• Ability to translate technical risk into business terms.

Responsibilities

• Embed security in engineering teams across SDLC.
• Lead application security and automated testing in CI/CD pipelines.
• Conduct threat modelling sessions with dev teams.
• embed security controls early in lifecycle and promote DevSecOps practices.
• Ensure end-to-end security of cloud products (containers, APIs, apps).
• Communicate risk to non-technical stakeholders.
• Collaborate with security testers for code reviews and scans.

Skills

Cloud security

DevSecOps

Application security

Threat modelling

Risk management

Security testing

Communication

Tools

SAST tooling

DAST tooling

CI/CD security

IAM & CIS controls

Job description

Job Title:

Security Analyst / Security Consultant

Location:

Remote (actually remote. No “mandatory culture days”)

Salary:

£55,000 + 10% Bonus and Benefits

Let’s skip the corporate fluff.

This is a Security Analyst / Consultant role for someone who gets it.

Someone who knows that “secure by design” isn't just something you write in a Confluence doc. Someone who knows risk isn’t always a red RAG status - and can explain the difference between a real issue and a theoretical one.

We're building secure products across a complex cloud environment (yes, both Azure and AWS). You’ll be the person making sure what we build isn’t just functional - but secure, sustainable, and risk-aware.

What you’ll actually be doing:

• Embedding yourself in engineering teams, making sure security is considered before, during and after development - not after someone clicks deploy.
• Leading the charge on application security - from secure coding principles to automated AppSec testing in CI/CD pipelines.
• Running (or helping run) threat modelling sessions and ensuring they're more than just drawing spiders on whiteboards.
• Working with devs and testers to embed security controls early in the lifecycle.
• Bringing DevSecOps principles into play - not just sprinkling tools into pipelines and calling it a day.
• Providing end-to-end security assurance of cloud-based products - containers, APIs, apps, infrastructure.
• Translating technical risk into business language that makes sense to non-technical decision-makers.
• Partnering with security testers to ensure ethical hacking, code reviews, infrastructure scans, and app assessments are done properly - not tick-box-style.

You should probably already know a bit about:

• Cloud security across Azure and AWS – IAM, storage, networking, serverless, containers, monitoring. Not expecting you to be a cloud architect, but you should know your way around.
• DevSecOps practices – secure pipelines, IaC security, dependency scanning, GitHub/Jenkins integrations.
• Application security – OWASP Top 10, SAST/DAST tooling, secrets management, API security.
• Threat modelling – Ideally STRIDE, or something better. And you can do it with a dev team, not just in theory.
• Vulnerability and risk management – and how to avoid both being reduced to spreadsheets.
• Frameworks like NIST, MITRE ATT&CK, Cyber Kill Chain, and compliance stuff like PCI-DSS.
• SIEMs, WAFs, DLPs, EDRs, and all the other acronym-heavy tools you’ve learned to assess critically.

You’ll do well here if:

• You speak fluent “tech” and “business”.
• You can spot a security gap without being a pain about it.
• You’re comfortable saying “no” - but you always explain why.
• You’re curious, self-driven, and allergic to box-ticking.
• You can back your views up with data, experience, or even just logic.

Letters & certs are nice (but not essential):

• Or you’ve just done the job long enough that you know your stuff without the need for badges.

If you're looking for a clipboard and a checklist, this isn't it.