Job Title: Security Analyst / Security Consultant
Location: Remote (actually remote. No “mandatory culture days”)
Salary: £55,000 + 10% Bonus and Benefits
Let’s skip the corporate fluff.
This is a Security Analyst / Consultant role for someone who gets it.
Someone who knows that “secure by design” isn't just something you write in a Confluence doc. Someone who knows risk isn’t always a red RAG status - and can explain the difference between a real issue and a theoretical one.
We're building secure products across a complex cloud environment (yes, both Azure and AWS). You’ll be the person making sure what we build isn’t just functional - but secure, sustainable, and risk-aware.
What you’ll actually be doing:
* Embedding yourself in engineering teams, making sure security is considered before, during and after development - not after someone clicks deploy.
* Leading the charge on application security - from secure coding principles to automated AppSec testing in CI/CD pipelines.
* Running (or helping run) threat modelling sessions and ensuring they're more than just drawing spiders on whiteboards.
* Working with devs and testers to embed security controls early in the lifecycle.
* Bringing DevSecOps principles into play - not just sprinkling tools into pipelines and calling it a day.
* Providing end-to-end security assurance of cloud-based products - containers, APIs, apps, infrastructure.
* Translating technical risk into business language that makes sense to non-technical decision-makers.
* Partnering with security testers to ensure ethical hacking, code reviews, infrastructure scans, and app assessments are done properly - not tick-box-style.
You should probably already know a bit about:
* Cloud security across Azure and AWS – IAM, storage, networking, serverless, containers, monitoring. Not expecting you to be a cloud architect, but you should know your way around.
* DevSecOps practices – secure pipelines, IaC security, dependency scanning, GitHub/Jenkins integrations.
* Application security – OWASP Top 10, SAST/DAST tooling, secrets management, API security.
* Threat modelling – Ideally STRIDE, or something better. And you can do it with a dev team, not just in theory.
* Vulnerability and risk management – and how to avoid both being reduced to spreadsheets.
* Frameworks like NIST, MITRE ATT&CK, Cyber Kill Chain, and compliance stuff like PCI-DSS.
* SIEMs, WAFs, DLPs, EDRs, and all the other acronym-heavy tools you’ve learned to assess critically.
You’ll do well here if:
* You speak fluent “tech” and “business”.
* You can spot a security gap without being a pain about it.
* You’re comfortable saying “no” - but you always explain why.
* You’re curious, self-driven, and allergic to box-ticking.
* You can back your views up with data, experience, or even just logic.
Letters & certs are nice (but not essential):
* Security+, CISM, CISSP, CCSK, CCAK, Azure/AWS security certs, MSc Cybersecurity, etc.
* Or you’ve just done the job long enough that you know your stuff without the need for badges.
Apply if that sounds like you.
If you're looking for a clipboard and a checklist, this isn't it.