Security Consultant - FTC in Stirling

At M&G, our purpose is to give everyone real confidence to put their money to work. With a heritage dating back more than 175 years, we have a long history of innovation in savings and investments, combining asset management and insurance expertise to offer a wide range of solutions. Our two distinct operating segments, Asset Management and Life, work together to provide access to balanced, long-term investment and savings solutions.

The Security Consultancy (SecCon) team are information technology specialists at the forefront of ensuring our technology change initiatives are delivered securely. We need leaders who are technical security experts and are confident dealing with a range of stakeholders from IT, the business, and strategic partners. You will be working on exciting new change initiatives, helping security and our business partners to achieve the digital ambitions across web, mobile and cloud.

As a Security Consultant within M&G you’ll have the opportunity to lead change, working on a wide range of different projects & platforms, translating best practice into high level security requirements, researching modern technologies to assess designs for implementation, and explaining threats and vulnerabilities to stakeholders in support of risk management. You’ll also be working closely with our security engineers to understand and develop the enterprise’s security architecture and integrate them into change initiatives.

Primary Key Responsibilities:

• Ensuring technical and solution designs are compliant with our controls, be able to articulate a position on the security of the design and work with platform teams to remediate any gaps.
• Working with 1st line risk and technology teams to assess the implications of any control gaps which cannot be remediated.
• Act as the entry point for Security and provide security advice and guidance, including identifying and assessing security threats, vulnerabilities, and risks for all change and BAU initiatives.
• Representing enterprise security at technical design authorities to ensure solutions presented meet security best practice.
• Work with different areas in enterprise security to reduce friction and apply necessary security integrations for new technologies and ensure Security is embedded in solutions as early as possible.

Additional Responsibilities:

• Remain current with emerging security technologies and feed into strategic technology discussions.
• Tailor and present complex data to different stakeholders.
• Provide security advice and guidance to technology programs, third party integrations, supply chain engagements and longer term projects.
• Focus on future developments, technologies and regulations which could affect the firm or our partners, and the impact they could have on our controls.
• Excellent written and verbal communication with technical and non-technical stakeholders, IT teams, and external partners.
• Key involvement in technical design governance process.
• Provide guidance and support during the implementation of security measures and technologies.
• Prepare comprehensive reports and documentation detailing findings, recommendations, and action plans.
• Analyse security risks and develop risk management strategies.
• Assist in creating and updating security policies, standards, and procedures to ensure control compliance and best practices.

Key Stakeholders Management:

• Internal: Business and technology stakeholders at all levels.
• External: External vendors (where required).

Knowledge:

• A good understanding of Azure security is essential and M365 / Microsoft Power Platform security capabilities would be an advantage.
• An excellent understanding of securing applications, infrastructure and networks.
• This includes a detailed understanding of security technologies required to secure an enterprise, their capabilities and interoperability covering:
• Cyber / Web Security (Firewalls, DoS, Proxies, CDN / WAF, API Gateways etc.).
• Threat & Incident Management (SOC, SIEM, Threat Intelligence, etc).
• Data Security (DLP, DRM, etc).
• IDAM (FIAM, SSO, etc).
• Experience of Azure AD would be advantageous.
• Mobile Security (EMM, MAM, MDM etc).
• Cryptography (including Key Management and PKI).
• Desktop / Server / Virtualisation Security (vulnerability and patch management, malware protection, etc).
• Working knowledge of infrastructure and application security requirements.
• Detailed working knowledge of infrastructure and application security requirements, demonstrated through understanding of recognised information security management and governance frameworks such as, ISF Standards of Good Practice, NIST 800-53 or CIS 7.1.
• An understanding of the regulations and legislation that apply to a pension and investment organisation would be advantageous.

Skills:

• Strong stakeholder management skills.
• Highly organised, excellent prioritisation and planning skills.
• Confident and effective communicator (both written and verbal) across all levels of the organisation to influence using risk-based reasoning.
• Extensive experience in articulating complex requirements as easy to understand security designs using threat profiling, reusable models and architecture principles.
• Ability to work alone or as part of a team, whilst working on multiple items at the same time.
• Ability to work with limited supervision, seeking guidance where appropriate.
• Ability to translate complex technical issues into meaningful details for non-specialist audiences.
• Ability to understand organisational culture and use this knowledge to gain commitment and get work done.
• Strong facilitation skills to elicit information from key stakeholders internally and externally.
• Creative thinking to contribute to the overall solution design.
• Proven and demonstrable analytical and problem-solving skills essential, with the ability to think laterally and generate creative solutions.
• Excellent organisational and prioritisation skills with a keen attention to detail and ability to manage multiple deliverables, with complexity.
• Strong risk mindset to support project engagements in risk identification and mitigation proposals.
• Excellent interpersonal communication skills and establishing professional rapport.
• Good negotiating skills.
• Good problem-solving skills.

Experience:

• 10+ years of experience in Information/Cyber Security with at least 4 years as an experienced Security Consultant with a proven track record in successful delivery.
• Extensive experience of working in a business facing IT or Cyber Security role, ideally within a regulated environment.
• Experience of securing applications, infrastructure and networks.
• Experience of securing cloud / cloud hybrid services (including IaaS, PaaS and SaaS variances) as well as mobile security models.
• Experience of Salesforce, Oracle Cloud Infrastructure and Adobe Experience Manager would be advantageous.

Educational Qualifications:

• Bachelor’s/Master’s degree or an equivalent professional qualification.
• A recognised information security qualification, such as CISSP, CISM, CCSK etc.

What we offer:

We’re dedicated to supporting your wellbeing and helping you thrive, both at work and beyond. Our benefits are designed to help you balance your professional and personal life, and financially plan for the future. Our UK benefits include:

• A valuable pension scheme of up to 18% (13% made up of employer contributions and 5% employee contributions).
• Access to our Share Save and Share Incentive Plan, alongside financial wellbeing and support services.
• Enjoy 38 days annual leave (including bank holidays), with the opportunity to purchase up to five extra days.
• Our Time Off When You Need It policy gives you the flexibility to balance work and personal commitments.
• Our market-leading Inspiring Families policy includes comprehensive support and paid parental leave covering maternity, adoption, surrogacy, and paternity leave.
• Health & Protection cover includes Private Healthcare, Critical Illness cover and Life Assurance for you, with additional family options.

At M&G we strive to have a diverse workforce and an inclusive culture, underpinned by our policies and employee-led networks that offer networking, support and development opportunities for the diverse communities our colleagues represent. We welcome applications from people of all backgrounds – across gender, ethnicity, age, disability, sexual orientation and more – including neurodivergent individuals, career returners and those with military service experience.

M&G is proud to be Level 3: Disability Confident Leader under the UK Government Disability Confident employer scheme, and we welcome applications from candidates with disabilities and long-term health conditions. If you would like to participate in the initiative, you will have the opportunity to indicate this on your application.

We are committed to providing an inclusive recruitment process. All candidates have the opportunity to request reasonable adjustments when applying. If you need any additional support at any stage, please contact us at: careers@mandg.com