Working in a client-facing consultancy role, you will provide operational security management, oversight and GRC advisory services. You will help clients translate business, threat and regulatory requirements into practical operational risk decisions and security improvements.

• Security governance and oversight: Establish, operate and improve proportionate security governance, policies, standards, control frameworks, decision forums and reporting. Provide independent oversight of security performance, control ownership, risk treatment and remediation.
• Operational security management: Oversee day-to-day security risks across technology and service environments, ensuring that vulnerabilities, threats, alerts, incidents and control weaknesses are assessed, prioritised, assigned and progressed to closure.
• Vulnerability and exposure oversight: Review vulnerability and security testing outputs, challenge prioritisation using asset criticality, exploitability, threat intelligence and business impact, and monitor remediation, exceptions and risk acceptance.
• Threat and alert oversight: Work with security operations, technology and service teams to interpret threat intelligence and material alerts, identify emerging exposure, confirm appropriate response and escalate risks requiring management action.
• Risk management: Facilitate risk identification and assessment, maintain risk and issue records, define treatment plans, evaluate residual risk and support accountable risk acceptance. Ensure clear traceability from threats and vulnerabilities to risks, controls and actions.
• Control assurance and compliance: Assess the design and operating effectiveness of security controls against contractual, legal, regulatory and recognised framework requirements, including ISO/IEC 27001, NIST CSF and applicable sector obligations.
• Audit and remediation: Plan and support internal and external audits, coordinate evidence, respond to findings and maintain oversight of corrective actions. Challenge closure evidence and report overdue, systemic or material control gaps.
• Security reporting: Produce concise management information covering risk exposure, vulnerabilities, threats, alerts, incidents, control performance, compliance and remediation. Use defined data sources, thresholds and trends to support risk-based decisions.
• Stakeholder and client engagement: Act as a trusted adviser to client security leaders, service owners, technical teams, auditors and third parties. Translate complex operational and regulatory matters into clear decisions, ownership and action.
• Consulting delivery: Lead or contribute to security assessments, governance reviews, operating model development, control improvement programmes and client deliverables. Shape pragmatic recommendations that are proportionate to the client’s risk appetite and operating context.
• Continuous improvement: Identify recurring weaknesses and opportunities to simplify governance, strengthen controls, improve data quality and embed sustainable security practices.