Working in a client-facing role, you will coordinate and manage operational security activities across client, security, technology, service-provider and third-party teams. You will ensure that vulnerabilities, threats, incidents, security risks and control weaknesses are understood, prioritised and managed through to evidenced resolution or formally approved risk acceptance.

You will provide the coordination between technical security specialists, service-management teams and accountable business owners. This will include translating technical findings into clear operational priorities, managing dependencies, resolving ownership issues and escalating material risks where management action is required.

Your responsibilities will include:

• Operational security management: Coordinate day-to-day security activities across technology and service environments. Establish operational priorities, confirm ownership, manage dependencies and ensure that material security issues are progressed within agreed timescales.
• Technical security coordination: Act as the coordination point between security operations, vulnerability management, incident response, infrastructure, cloud, network, application and service-management teams. Interpret technical findings and ensure that the appropriate investigation, remediation or risk-management activity is initiated.
• Vulnerability and exposure management: Coordinate the assessment and prioritisation of vulnerabilities and exposures using technical severity, exploitability, threat intelligence, asset criticality and business impact. Oversee remediation activity, exceptions, compensating controls and risk acceptance, challenging delays or insufficient closure evidence where necessary.
• Incident preparedness and improvement: Support the development and maintenance of incident-response plans, playbooks, escalation routes and communication arrangements. Coordinate post-incident reviews and ensure that lessons, risks and corrective actions are recorded, assigned and tracked through to closure.
• Risk acceptance and exceptions: Coordinate security exception and risk-acceptance processes, ensuring that decisions are supported by appropriate analysis, compensating controls, accountable ownership, defined review dates and formal approval at the appropriate level.
• Control assurance and compliance: Assess whether security controls are appropriately designed, implemented and operating effectively against contractual, legal, regulatory and recognised framework requirements, including ISO/IEC 27001 and the NIST Cybersecurity Framework.
• Service-management integration: Work with incident, problem, change, configuration, asset, continuity and supplier-management processes to ensure that security requirements and actions are embedded within normal service operations.
• Change and operational readiness: Review significant technology and service changes to identify operational security implications. Confirm that relevant risks, controls, monitoring, support arrangements and operational responsibilities have been addressed before implementation or transition into service.
• Supplier and third-party coordination: Work with suppliers and service providers to maintain oversight of security responsibilities, incidents, vulnerabilities, control performance and remediation commitments. Escalate material or persistent delivery concerns through the appropriate commercial and governance routes.
• Audit and remediation: Coordinate internal and external audit and assurance activity, evidence provision and responses to findings. Review corrective-action plans, challenge insufficient closure evidence and escalate material, systemic or overdue control weaknesses.
• Security reporting: Produce concise operational security reporting covering vulnerabilities, threats, incidents, risk exposure, control performance, exceptions and remediation. Define meaningful indicators, thresholds and trends using reliable data sources to support prioritisation and management decisions.
• Stakeholder and client engagement: Work with client security leaders, risk owners, service owners, technical teams, suppliers, auditors and other stakeholders to translate technical security matters into clear business decisions, accountable ownership and practical action.
• Consulting delivery: Lead or contribute to operational security assessments, governance reviews, control-improvement initiatives and operating-model development. Produce practical recommendations that reflect the client’s risk appetite, regulatory obligations and operating environment.
• Continuous improvement: Identify recurring operational weaknesses and implement sustainable improvements to security processes, controls, tooling, reporting, data quality and cross-team working.