Lead Security by Design Consultant in Yeovil, Somerset

Lead Security by Design Consultant

Location: Yeovil (2-3 days per week onsite)

Duration: 12 month initial contract

Rate: £120ph LTD (Outside IR35)

• Experience with DefStan 05-139 required
• Active SC required

Role details:
We are looking for a Lead Security by Design Consultant to support a major defence aviation programme in Yeovil. This contract role will lead cyber and information security activities across the engineering lifecycle, from requirements definition and design through to in-service support and maintenance.

• Lead the generation and maintenance of security management plans, assurance artefacts, cyber security risk reports and security cases across the engineering lifecycle.
• Translate customer requirements into actionable security plans, statements of work and technical deliverables for key programme reviews, including SRR, PDR, CDR and TRR.
• Deliver security work packages and associated artefacts to agreed time, cost and quality requirements.
• Conduct cyber and information security risk assessments, including threat modelling, vulnerability analysis and evaluation of mitigation strategies.
• Identify, manage and escalate technical, delivery and supply chain risks in line with customer, regulatory and legislative expectations.
• Manage internal and external relationships for the cyber and information security workstream, supporting working groups, workshops and security forums.
• Provide security guidance to product engineers, system architects and developers, including advice on secure software design, platform lockdown and configuration.
• Coordinate security verification, validation and remedial action activities while promoting knowledge sharing across the programme and security teams.

• Significant experience delivering cyber security and information security services within the Defence sector, ideally in a defence aviation environment.
• Experience of Def Stan 05-138 and Def Stan 05-139, including red and black channel product development and delivery.
• Strong knowledge of secure by design principles, MOD accreditation processes and security lifecycle practices, including ISN2023/09.
• Experience producing security management plans, lifecycle documentation, assurance artefacts and other contractual security deliverables.
• Expertise in high-integrity software, secure software design and security considerations for software, firmware and electronic hardware.
• Understanding of NIST Special Publications, including SP 800-30, SP 800-37 and SP 800-53, alongside supply chain risk management under NIST SP 800-161 or ISO 28000.
• Ability to decompose cyber security requirements into system or process control levels and assess detailed technical and security designs.
• Excellent communication, presentation, consulting, stakeholder management and decision-making skills, with the ability to work independently and collaboratively.

• Degree or master's degree in cyber security, systems engineering, software engineering or a comparable discipline, or relevant equivalent experience.
• Recognised professional cyber security certifications such as CISSP, CISM, CASP/SecurityX or comparable security qualifications are desirable.
• Active Security Check (SC) clearance is required.
• Knowledge of ARP4754A, ARP4761 and RTCA-DO-326A/B, DO-355A and DO-356A would be advantageous.
• Understanding of engineering lifecycle processes and key gate review activities.

If you are an experienced cyber security professional with a strong background in secure by design and defence aviation, this is an excellent opportunity to contribute to a significant programme. Apply now to be considered for the Lead Security by Design Consultant contract in Yeovil.