Security Engineering Consultant

Security Engineer / Security Consultant (Application Security & Threat Modelling)

Rate – £550 – £650 Outside IR35
Duration – 6 months initial
Location – Bristol / London (once a week / remote)

Role overview:

A leading Financial Services is seeking an experienced Security Engineering Consultant on a contract basis. The successful candidate will be embedded within engineering tribes, providing security consultancy and guidance to development teams throughout the software development lifecycle.

The primary focus of the role is threat modelling. The consultant will conduct threat models for new and existing products, identify risks at the design stage and work with developers to mitigate those threats during development, ensuring that products are secure by design.

Key responsibilities:

• Conduct and document threat models across products and services, from initial design through to delivery
• Work with development teams to mitigate identified threats during development
• Provide security consultancy and guidance to engineers, product owners and architects
• Embed secure development practices across the SDLC and support the adoption of DevSecOps
• Support application security activities, including secure design reviews and security testing
• Manage and improve vulnerability management processes, supporting teams with prioritisation and remediation
• Produce threat modelling diagrams and supporting documentation for use by delivery teams
• Support the development of security knowledge within engineering teams

Essential requirements:

• Significant experience in threat modelling – experience using IriusRisk or comparable threat modelling tools
• Experience in application security, with detailed knowledge of OWASP standards and web application security
• Experience of DevSecOps practices, including integrating security controls into CI/CD pipelines
• Knowledge of the secure SDLC within agile delivery environments
• Experience of vulnerability management
• Working knowledge of Kubernetes and container security
• The ability to communicate security risks clearly to technical and non-technical stakeholders

Reasonable Adjustments:

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.

If you need any help or adjustments during the recruitment process for any reason, please let us know when you apply or talk to the recruiters directly so we can support you.