Senior Cybersecurity Audit and Assurance Specialist in Cheltenham

The CDS Defence & Security CNSI Senior Cybersecurity Audit and Assurance Specialist provides independent, evidence-led assurance across cyber security, information risk, and resilience, with a strong focus on regulated, defence, and high assurance environments. This is a senior position for an experienced audit professional who either holds an audit chartership (such as Chartered Auditor from CIISec or Chartered Internal Auditor) or is actively working towards one. The role underpins the organisation’s ability to deliver higher assurance services, including Defence Cyber Certification (DCC) Level 2 and above, formal certification audits, and board level assurance. The post holder acts as a lead auditor and a recognised source of expertise in cyber audit and assurance, ensuring that assessments are technically robust, grounded in sound audit methodology, and defensible to external scrutiny. This role requires independence, mature professional judgement, and strong audit discipline across people, process, technology, and governance, built on an extensive track record of delivering audit and assurance work.

Main Responsibilities

• Lead and deliver external cyber security audit, assurance, and certification engagements using recognised audit and assurance methodologies.
• Plan, manage, and execute audits across the full audit lifecycle, including scoping, planning, fieldwork, evidence review, reporting, and follow-up.
• Act as Lead Auditor or Lead Assessor for high assurance and regulated engagements.
• Conduct evidence-based assessments of control design and operational effectiveness across people, process, technology, and third-party dependencies.
• Perform structured audit interviews, sampling, and testing activities in line with scheme or regulatory requirements.
• Identify non-conformities, weaknesses, and residual risks, and articulate their business and security impact.
• Deliver assessments and assurance activity against recognised frameworks and schemes, including:
• Defence Cyber Certification (DCC) up to and including Level 2 (with support to Level 3 progression)
• Cyber Essentials
• ISO/IEC 27001 and supporting standards (e.g. ISO/IEC 27002, ISO/IEC 27005)
• NIST Cybersecurity Framework and relevant NIST Special Publications
• Produce high-quality, defensible audit and certification reports that meet certification body, accreditation, and client expectations.
• Act as a senior technical authority for cyber security audit and assurance within CNSI.
• Contribute to the development, maintenance, and continual improvement of audit methodology, quality controls, and assurance processes.
• Review audit evidence, working papers, and reports to ensure consistency, quality, and professional rigour.
• Support organisational uplift toward higher assurance maturity, including Certification Body capability and scheme readiness.
• Mentor and provide technical guidance to other cybersecurity specialists, promoting audit discipline, evidence handling, and professional judgement.
• Act as a senior client-facing assurance lead, communicating complex technical and assurance matters clearly to executive and non-technical stakeholders.
• Uphold independence, ethical standards, confidentiality, and conflict of interest management at all times.

Experience, Certifications and Qualifications

The role holder is expected to demonstrate most of the following:

• Extensive experience (typically 8+ years) delivering cyber security audit and assurance services, ideally across defence, government, regulated, or high assurance environments.
• A strong track record of leading evidence-based audit planning, execution, and reporting on complex engagements.
• In-depth practical understanding of audit principles, assurance methodologies, control testing, and evidence evaluation.
• Experience aligned with the UK Cyber Security Council Standard of Professional Competence and Commitment – Cyber Security Audit and Assurance at Principal level, with progression towards Chartered level.
• An audit chartership, or active progress towards one, for example:
• Chartered Auditor or Chartered Internal Auditor (held or in progress)
• Chartered Cyber Security Professional in the Audit and Assurance specialism (held or in progress)
• Enrolment on, or a clear commitment to completing, a recognised audit chartership pathway
• Lead auditor or assessor experience against frameworks such as ISO/IEC 27001, NIST, Cyber Essentials, and defence-oriented assurance schemes.
• Ability to communicate clearly and authoritatively in writing and verbally, including presenting findings to senior management, boards, and audit committees.
• Experience mentoring or guiding other specialists within an assurance or audit-led environment.
• Commitment to continuous professional development, ethical practice, and maintenance of professional competence.

Appropriate security clearance (or eligibility to obtain clearance) will be required for defence and sensitive engagements.