About This Role
This security consultant role focuses on operational security management, oversight, and GRC advisory services within a client-facing capacity. The consultant will help clients translate various requirements into practical operational risk decisions and security improvements.
Responsibilities
- Establish, operate, and improve proportionate security governance, policies, standards, control frameworks, decision forums, and reporting
- Provide independent oversight of security performance, control ownership, risk treatment, and remediation
- Oversee day-to-day security risks across technology and service environments, ensuring that vulnerabilities, threats, alerts, incidents, and control weaknesses are assessed, prioritised, assigned, and progressed to closure
- Review vulnerability and security testing outputs, challenge prioritisation using asset criticality, exploitability, threat intelligence, and business impact, and monitor remediation, exceptions, and risk acceptance
- Work with security operations, technology, and service teams to interpret threat intelligence and material alerts, identify emerging exposure, confirm appropriate response, and escalate risks requiring management action
- Facilitate risk identification and assessment, maintain risk and issue records, define treatment plans, evaluate residual risk, and support accountable risk acceptance
- Ensure clear traceability from threats and vulnerabilities to risks, controls, and actions
- Assess the design and operating effectiveness of security controls against contractual, legal, regulatory, and recognised framework requirements, including ISO/IEC 27001, NIST CSF, and applicable sector obligations
- Plan and support internal and external audits, coordinate evidence, respond to findings, and maintain oversight of corrective actions
- Challenge closure evidence and report overdue, systemic, or material control gaps
- Produce concise management information covering risk exposure, vulnerabilities, threats, alerts, incidents, control performance, compliance, and remediation
- Use defined data sources, thresholds, and trends to support risk-based decisions
- Act as a trusted adviser to client security leaders, service owners, technical teams, auditors, and third parties
- Translate complex operational and regulatory matters into clear decisions, ownership, and action
- Lead or contribute to security assessments, governance reviews, operating model development, control improvement programmes, and client deliverables
- Shape pragmatic recommendations that are proportionate to the client’s risk appetite and operating context
- Identify recurring weaknesses and opportunities to simplify governance, strengthen controls, improve data quality, and embed sustainable security practices
