Job Description:
We are seeking an experienced Secure by Design Lead & Cyber Risk Advisor to drive Secure by Design practices across a portfolio of MOD and Public Sector digital services. You will lead risk identification, mitigation, and assurance activities, ensuring that products and services are designed, built, and operated securely while aligned with organisational and Authority risk appetites.
This role requires deep understanding of cyber risk methodologies, excellent communication skills, and the ability to guide multi‑disciplinary teams through Secure by Design processes at pace. You will act as the primary advisor on cyber risk and SbD compliance, producing concise, decision‑ready outputs and leading security assurance activities.
Key Responsibilities
Secure by Design Leadership
1. Lead Secure by Design discovery and assessment activities across digital services and portfolios.
2. Provide Secure by Design risk and security assurance functions within MOD/Public Sector accounts.
3. Define pragmatic security control expectations aligned to service context and business risk appetite.
4. Coach delivery teams to adopt secure working practices in Agile and iterative environments without impeding delivery speed.
Risk Assessment & Threat Modelling
5. Conduct cyber risk assessments using NIST 800‑30/37 (rev.5), ISO 27005, and NIST Cyber Security Framework (CSF).
6. Perform threat modelling using STRIDE, attack trees, and other contemporary analytical methods.
7. Identify vulnerabilities, threats, impacts, and control gaps to inform risk treatment decisions.
8. Carry out technical and control-based risk assessments, incorporating outcomes of architecture reviews and testing activities.
Risk Treatment & Remediation Planning
9. Develop actionable, prioritised risk remediation plans, including responsibilities, timelines, and mitigation steps.
10. Provide pragmatic and business‑aligned risk remediation guidance, balancing operational needs with security obligations.
11. Work closely with risk owners and technical leads to negotiate and agree treatment strategies.
Governance, Assurance & Reporting
12. Support governance and assurance forums by articulating risk, mitigation options, and residual exposure.
13. Produce concise, informative documentation including:Risk assessment reportsThreat modelling outputsVulnerability and control analysisResidual risk statementsSecure by Design compliance evidence
14. Validate that required control patterns, assurance activities, and security testing have been completed.
Stakeholder Collaboration & Workshops
15. Facilitate security, risk, and threat modelling workshops with multi‑disciplinary teams and Authority stakeholders.
16. Engage with business and technical stakeholders to ensure alignment with broader transformation goals and regulatory requirements.
17. Work with MOD/Public Sector teams to ensure security expectations and compliance obligations are met.
Compliance & Evidence Production
18. Identify, collect, and review evidence demonstrating compliance with Secure by Design principles.
19. Produce documentation including:Risk assessmentsSecurity testing resultsEvidence packs for Secure by Design complianceResidual risk reports
Leadership, Coaching & Knowledge Sharing
20. Mentor junior consultants, technical specialists, stakeholders and program across multiple business units.
21. Produce and deliver awareness sessions on Secure by Design, secure development, governance, and best practice.
22. Promote a culture of continuous security improvement.
Skills & Experience Required
Essential
23. Eligibility for UK security clearance
24. Proven experience leading Secure by Design across portfolios or multiple digital services.
25. Strong experience supporting MOD, Defence, or UK Public Sector clients.
26. Deep expertise in cybersecurity risk frameworks including:NIST 800‑30/37ISO 27005NIST CSF
27. Demonstrated ability to facilitate structured threat modelling (STRIDE, attack trees).
28. Highly skilled in producing clear, concise, decision‑focused reporting for senior stakeholders.
29. Strong capability in running governance, risk, and assurance activities.
30. Experience working with Agile, DevOps, and multi‑disciplinary delivery teams.
31. Excellent stakeholder management and communication skills.
32. Experience in Secure by Design frameworks used within Defence and Government.
33. Knowledge of MOD security governance, assurance, and accreditation processes.
34. Background risk consultancy, or security assurance.
35. Certifications such as CISM, CRISC, CISSP, SABSA, CCP, or equivalent.
What You Will Deliver
36. Secure by Design discovery assessments and control expectations.
37. Threat models, risk assessments, vulnerability analyses.
38. Risk remediation action plans with clear owners and timelines.
39. Concise assurance documentation and residual risk reports.
40. Secure by Design compliance evidence aligned to programme and Authority requirements.
41. Clear risk recommendations supporting decision‑making and governance.
At DXC Technology, we believe strong connections and community are key to our success. Our work model prioritizes in-person collaboration while offering flexibility to support wellbeing, productivity, individual work styles, and life circumstances. We’re committed to fostering an inclusive environment where everyone can thrive.