UK remote
Security Consultant
About this role
We are seeking a hands-on Security Consultant who can combine deep technical delivery capability with strong client-facing consulting skills. The ideal candidate will be comfortable assessing, designing, improving and governing security controls across cloud environments, applications, APIs, infrastructure and enterprise security domains. This role requires someone who can challenge customer security assumptions, influence stakeholders, and lead difficult but constructive conversations to drive secure outcomes.
Key Responsibilities Assess current-state security maturity, identify control gaps, and define pragmatic remediation roadmaps aligned to business priorities. Lead and support security architecture reviews across cloud, applications, infrastructure, IAM, data protection and detection/response domains. Provide expert consulting to customers on security strategy, risk reduction, control design, and security operating model improvements.
Challenge weak security assumptions with confidence, using evidence-based recommendations and clear communication with technical and non-technical stakeholders. Design and review secure cloud landing zones, network segmentation, identity models, logging/monitoring patterns, and guardrails. Partner with engineering, platform, DevOps and operations teams to embed security into delivery pipelines and infrastructure as code practices.
Support threat detection, incident response readiness, use-case tuning, and post-incident improvement activities. Contribute to security standards, policies, patterns, reusable accelerators, and client-facing deliverables including assessments, risk registers and executive summaries. Required Hands-On Experience 1. Cloud Security (preferably AWS) Hands-on experience securing cloud environments, preferably AWS, including core services, networking, identity, logging, encryption and security monitoring.
Experience reviewing or implementing secure cloud architectures, landing zones, account/project structures, and preventative/detective controls. Knowledge of cloud-native security services and best practices for workload, storage, network and platform protection. 2. Application / API Security Experience identifying and mitigating application and API security risks across the software delivery lifecycle. Understanding of secure design principles, common web/API vulnerabilities, authentication/authorization models, secrets management and secure SDLC practices.