Cyber Security Risk Specialist in Glasgow

On behalf of the MOD we are looking for a Cyber Security Risk Specialist (Inside IR35) for a 12 month contract. Hybrid working based in Glasgow or Blackpool. The Ministry of Defence (MOD) is a central government department with a mission to protect our country and provide the ultimate guarantee of its security and independence, as well as helping to protect its values and interests abroad. We are looking for an experienced and enthusiastic Cyber Security Risk Specialist who can bridge the gap between technical cyber security and enterprise risk management. This role is not simply about maintaining risk registers. It is about understanding technology, identifying realistic threats, assessing vulnerabilities, evaluating control effectiveness and helping Defence leaders make informed risk decisions. You will work across projects, programmes and live services to identify and assess cyber security risk, challenge assumptions, develop realistic threat scenarios and support continuous improvement of the cyber security control environment. Working alongside architects, engineers, delivery teams, assurance specialists and senior leaders, you will help ensure cyber risk is understood, communicated and managed effectively across the organisation.

As a Cyber Security Risk Specialist your main responsibilities will be:

• Leading cyber security risk assessments across projects, programmes and live services.
• Developing realistic threat scenarios using vulnerability intelligence, threat intelligence, attack techniques and system architecture information.
• Identifying, analysing and evaluating cyber security risks using established risk management methodologies.
• Assessing the effectiveness of cyber security controls and identifying opportunities to strengthen organisational resilience.
• Supporting Secure by Design activities and ensuring cyber risk considerations are embedded throughout service life cycles.
• Translating technical vulnerabilities, security weaknesses, audit findings and assurance outcomes into meaningful business risks.
• Working with risk owners to develop proportionate and achievable risk treatment plans.
• Supporting the maintenance of cyber risk registers, risk dashboards and management information.
• Monitoring emerging cyber threats, vulnerabilities and industry trends to ensure risk assessments remain current and relevant.
• Supporting cyber assurance activities aligned to the NIST Cybersecurity Framework (CSF), Cyber Assessment Framework (CAF) and Defence cyber security requirements.
• Providing advice and guidance to technical and business stakeholders on cyber risk matters.
• Supporting incident reviews, lessons identified activities and continuous risk management processes.
• Helping foster a positive cyber risk culture across Defence Business Services.

Essential:

• An active SC Clearance is an essential requirement for this role, as a minimum you must be willing & eligible to undergo checks.
• Demonstrable experience within cyber security, cyber risk management or information security.
• Strong technical understanding of modern technology environments, including cloud services, infrastructure, networking, identity and access management, and security controls.
• Experience assessing threats, vulnerabilities and control effectiveness.
• Knowledge and practical application of cyber risk management principles and methodologies.
• Ability to develop realistic cyber threat and attack scenarios based on available evidence and intelligence.
• Experience translating technical security issues into business-focused risk assessments.
• Strong analytical and problem-solving skills.
• Excellent stakeholder engagement, influencing and communication skills.
• Ability to present complex cyber security issues clearly to both technical and non-technical audiences.
• Experience producing high-quality reports, risk assessments and management information.

Desirable:

• Experience working within Defence, Government, Critical National Infrastructure or other highly regulated environments.
• Knowledge of the MOD Cyber Risk Management Framework (CRMF).
• Experience supporting Secure by Design activities.
• Experience conducting threat modelling or attack path analysis.
• Knowledge of vulnerability management and cyber threat intelligence processes.
• Familiarity with security assurance, audit and accreditation activities.
• Knowledge of UK GDPR, the Data Protection Act 2018 and information governance requirements.
• Knowledge of NCSC guidance, ISO 27001 or Government Security Profession frameworks.
• Experience using Microsoft 365, SharePoint and Power Platform solutions to support risk management activities.
• Oracle experience.

Please be aware that this role can only be worked within the UK and not Overseas.

Disability Confident: As a member of the Disability Confident Scheme, the MOD guarantees to interview all candidates who have a disability and who meet all the essential criteria for the vacancy. In cases where we have a high volume of candidates who have a disability who meet all the essential criteria, we will interview the best candidates from within that group. This scheme encourages candidates with a disability and/or neurodivergence to apply.

Armed Forces Covenant: The MOD guarantees to interview veterans or spouses/partners of military personnel who meet all the essential criteria for the vacancy. In cases where we have a high volume of ex-military candidates/military spouses or partners, who meet all the essential criteria, we will interview the best candidates from within that group.