About This Role
This security consultant role focuses on operational security management, oversight, and GRC advisory services within a client-facing capacity. The consultant will help clients translate various requirements into practical operational risk decisions and security improvements.
Responsibilities
- Establish, operate, and improve proportionate security governance, policies, standards, control frameworks, decision forums, and reporting
- Provide independent oversight of security performance, control ownership, risk treatment, and remediation
- Oversee day-to-day security risks across technology and service environments, ensuring that vulnerabilities, threats, alerts, incidents, and control weaknesses are assessed, prioritised, assigned, and progressed to closure
- Review vulnerability and security testing outputs, challenge prioritisation using asset criticality, exploitability, threat intelligence, and business impact, and monitor remediation, exceptions, and risk acceptance
- Work with security operations, technology, and service teams to interpret threat intelligence and material alerts, identify emerging exposure, confirm appropriate response, and escalate risks requiring management action
- Facilitate risk identification and assessment, maintain risk and issue records, define treatment plans, evaluate residual risk, and support accountable risk acceptance
- Ensure clear traceability from threats and vulnerabilities to risks, controls, and actions
- Assess the design and operating effectiveness of security controls against contractual, legal, regulatory, and recognised framework requirements, including ISO/IEC 27001, NIST CSF, and applicable sector obligations
- Plan and support internal and external audits, coordinate evidence, respond to findings, and maintain oversight of corrective actions
- Challenge closure evidence and report overdue, systemic, or material control gaps
- Produce concise management information covering risk exposure, vulnerabilities, threats, alerts, incidents, control performance, compliance, and remediation
- Use defined data sources, thresholds, and trends to support risk-based decisions
- Act as a trusted adviser to client security leaders, service owners, technical teams, auditors, and third parties
- Translate complex operational and regulatory matters into clear decisions, ownership, and action
- Lead or contribute to security assessments, governance reviews, operating model development, control improvement programmes, and client deliverables
- Shape pragmatic recommendations that are proportionate to the client’s risk appetite and operating context
- Identify recurring weaknesses and opportunities to simplify governance, strengthen controls, improve data quality, and embed sustainable security practices
Requirements
- Broad information security experience, comfortable moving between governance, operational oversight, and hands-on consultancy
- Five or more years’ experience in information security management, operational security, GRC, security consulting, risk, audit, or compliance roles
- At least one professional certification such as CISM, CISSP, CRISC, CISA, or ISO/IEC 27001 Lead Auditor or Lead Implementer
- Strong understanding of governance, risk, and control frameworks such as ISO/IEC 27001, NIST CSF, and NIST 800-53, together with relevant legal, regulatory, contractual, and sector requirements
- Experience overseeing vulnerabilities, threats, alerts, incidents, security risks, and remediation across enterprise technology or managed service environments
- Practical knowledge of vulnerability management and security operations, including risk-based prioritisation, escalation, exception management, and closure assurance
- Experience completing security risk assessments, control assessments, compliance reviews, or audits and translating findings into prioritised treatment plans
- Ability to define meaningful security measures, reporting, and RAG thresholds using reliable data sources to support management oversight and risk-based decisions
- Consulting experience, including discovery, stakeholder interviews, analysis, report writing, presenting recommendations, and supporting clients through implementation or remediation
- Credibility with senior stakeholders, technical teams, service providers, auditors, and regulators, with the confidence to provide constructive challenge and escalate material concerns
- A practical leadership style that balances independent oversight with direct involvement in resolving security issues and improving controls
- Clear written and verbal communication, with the ability to explain technical, risk, and compliance matters to both technical and non-technical audiences
- Strong attention to detail, sound judgement, and the ability to manage competing priorities in a client-facing environment
- A valid right to work in the UK and eligibility to obtain UK Security Check clearance
Nice to have:
- UK Cyber Security Council title (Practitioner)
Benefits
- Tailored benefits that support physical, emotional, and financial wellbeing
- Continuous growth and development opportunities
- Flexible work options
Important Details
- Work format: hybrid variable London or Birmingham
About the Company
NTT DATA is one of the world’s largest global security service providers, partnering with some of the most recognized security technology brands. The company offers an advanced portfolio of consulting, applications, business process, cloud, and infrastructure services. Its inclusive work environment prioritises mutual respect, accountability, and continuous learning.
