Technical Security Consultant

In this role you will strengthen the Secure SDLC capability across design, development, testing, release and operation. You will assess control effectiveness, tooling coverage and adoption in modern engineering environments, bridging security with engineering teams. You will map controls to NIST SSDF, OWASP SAMM and DSOMM, and facilitate cross-functional workshops to drive remediation and assurance reporting. This is an with-in-scope technical assurance role that shapes secure software practices at scale. You will work closely with engineering, product and security teams to reduce risk and improve maturity in secure software delivery.

• Assess Secure SDLC controls across design, development, testing, release and operation
• Review security architecture, tooling coverage, integration dependencies and control gaps
• Assess capabilities including SAST, SCA, DAST, secrets scanning, IaC scanning, API security, threat modelling and CI/CD security
• Map controls against frameworks including NIST SSDF, OWASP SAMM and OWASP DSOMM
• Review security tooling and integrations across GitHub, GitLab, CI/CD and cloud environments
• Conduct control-effectiveness assessments, evidence reviews and maturity/gap analysis
• Facilitate workshops with engineering, security and product teams
• Support KPI/KRI development, assurance reporting and remediation oversight

• Strong Secure SDLC, DevSecOps or Application Security experience
• Good understanding of security controls throughout the software development lifecycle
• Experience with security assurance, control frameworks, architecture or capability mapping
• Knowledge of application security tooling such as GitHub Advanced Security, CodeQL, Dependabot, Fortify, Qualys or Checkov beneficial
• Strong stakeholder management with the ability to challenge technical and engineering teams
• Knowledge of vulnerability management, exception governance and remediation processes advantageous
• SC clearance or ability to obtain SC clearance required

• stakeholder management
• ability to challenge and influence engineering teams
• facilitation and workshop leadership
• Secure SDLC
• DevSecOps
• Application security