At a Glance
- Tasks: Lead security assurance work and design audits for complex government systems.
- Company: Join Made Tech, a consultancy focused on secure digital services for the UK public sector.
- Benefits: Flexible working, competitive salary, and opportunities for professional growth.
- Other info: Collaborative culture with a focus on continuous improvement and client engagement.
- Why this job: Make a real impact on public sector security while mentoring others in a dynamic environment.
- Qualifications: Experience in security assurance and risk assessment methodologies.
The predicted salary is between 70000 - 90000 £ per year.
hackajob is collaborating with Made Tech to connect them with exceptional professionals for this role. We help UK public sector organisations build and run digital services that are secure, trustworthy, and resilient. As a Senior Security Assurance Engineer in our Cyber practice, you'll take end-to-end ownership of security assurance work across complex government environments - designing audit approaches, leading risk assessments, and helping clients understand and improve their security posture in ways that are proportionate, practical, and grounded in how their services actually work.
You'll operate across client engagements where the stakes are high - services that handle sensitive citizen data, systems that need to meet GovAssure and Cyber Assessment Framework requirements, and programmes navigating a demanding regulatory landscape that includes UK GDPR, the NIS Regulations, and the HMG Security Policy Framework. You'll be making informed judgements about what's proportionate for each context and helping clients make better decisions about risk.
At Senior level, you're also expected to raise the standard of security practice around you - not just through your own work, but by mentoring colleagues, contributing to how the team operates, and helping clients build their own capability over time. We're a consultancy that believes good security outcomes come from embedding security into delivery as a continuous concern, not bolting it on at the end.
- Design and lead security audits across complex government systems - combining automated scanning with manual testing, producing findings that are clearly framed around risk and remediation rather than just compliance status.
- Drive continuous compliance monitoring against applicable standards and regulations - Cyber Essentials, the NCSC Cyber Assessment Framework, GovAssure, UK GDPR, and NIS Regulations - feeding posture data into governance and risk reporting rather than treating it as a point-in-time exercise.
- Lead risk assessments and threat-modelling sessions, selecting methodologies (ISO 27005, NIST RMF, STRIDE, MITRE ATT&CK) that are proportionate to system criticality, and ensuring findings feed into programme governance decisions rather than sitting in security documentation alone.
- Communicate security findings and risk clearly to a range of audiences - technical detail for engineering teams, risk-framed summaries for senior stakeholders - structuring reports around the decisions people need to make, not just the controls you've tested.
- Embed security as a continuous engineering concern, supporting threat modelling and security reviews throughout delivery, challenging designs that create unnecessary risk, and mentoring colleagues on secure-by-default practices.
- Support and assess supply-chain and third-party security, creating proportionate assurance processes aligned with recognised standards and helping clients identify and address gaps in how they manage vendor and software supply-chain risk.
- Contribute to the commercial and strategic health of engagements, staying alert to unmet client needs, managing scope within contracted boundaries, and surfacing opportunities or risks.
