A major government organisation are looking for an experienced contract Principal Security Architect to join a transformation programme at a critical delivery phase.
Security Clearance — Active SC Required
Candidates must hold current, active Security Check (SC) clearance.
Sponsorship is not available for this role. Please do not apply if your clearance has lapsed or is pending renewal beyond a standard update.
CAF Skills and Experience
You will possess a strong understanding of the National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF) and its application within regulated and business-critical environments. They will have experience assessing, designing and assuring security controls against CAF objectives, including Managing Security Risk, Protecting Against Cyber Attack, Detecting Cyber Security Events and Minimising the Impact of Cyber Security Incidents.
The role requires the ability to interpret Indicators of Good Practice (IGPs), conduct security architecture reviews, perform threat modelling and risk assessments, and evaluate the effectiveness of technical and organisational controls in achieving desired security outcomes.
You must be capable of translating CAF requirements into practical architectural and operational improvements, ensuring security is embedded throughout the service lifecycle. This includes experience with secure-by-design principles, identity and access management, cloud and infrastructure security, vulnerability management, security monitoring, incident response and cyber resilience. Strong stakeholder management and communication skills are essential, with the ability to present security risks, assurance findings and remediation recommendations to both technical and senior leadership audiences. Experience of aligning security controls to recognised frameworks such as CAF, NIST and ISO 27001, and supporting audit, assurance and regulatory activities, would be highly desirable.
Essential Criteria:
- Practical experience applying the NCSC Cyber Assessment Framework (CAF).
- Security architecture design and assurance.
- Threat modelling and cyber risk assessment.
- Secure-by-Design and Secure SDLC practices.
- Identity and Access Management (IAM).
- Cloud, application and infrastructure security.
- Security monitoring and incident response.
- Vulnerability and remediation management.
- Security governance, audit and assurance.
- Ability to develop and deliver risk-based security recommendations.
