4 months ago
London, United KingdomStaff+
Responsibilities
- Own technical security architecture across engagements, including secure-by-default reference architectures and standards for identity, network segmentation, and data protection.
- Lead vulnerability remediation programmes using EPSS, KEV, CVSS, asset criticality, remediation SLAs, risk acceptance, and programme KPIs.
- Embed threat modelling, secure code review, SAST, SCA, dependency policy, container scanning, and security automation into engineering workflows.
- Design proportionate controls aligned with the NCSC Cyber Assessment Framework, GovAssure, Cyber Essentials, and HMG Security Policy Framework.
- Communicate security posture, remediation performance, and architectural risk to senior client stakeholders and government technical teams.
- Build and drive adoption of detection, alerting, and incident-response tooling, including the incident-response-to-vulnerability-management feedback loop.
- Mentor Made Tech colleagues and client engineers and create structured opportunities to grow security capability.
- Contribute to Cyber practice standards, hiring, technical calibration, external expertise, and the wider security engineering community.
Requirements
- Deep hands-on experience designing and building secure cloud architectures at scale using AWS, Azure, or GCP, including IAM, network segmentation, and data protection patterns.
- Proven experience embedding security tooling and automation into CI/CD pipelines and engineering workflows across multiple teams.
- Strong proficiency in at least one programming or scripting language used to build production-grade security tooling.
- Experience establishing and operating organisation-scale vulnerability remediation programmes with risk-based prioritisation.
- Experience designing systems that satisfy UK government security frameworks in complex multi-team or multi-supplier environments.
- Experience conducting or coordinating technical security reviews and penetration testing, remediating findings, and briefing senior technical stakeholders.
- Working knowledge of exposure management covering misconfiguration, identity exposure, and attack-path analysis using cloud-native tooling such as AWS Inspector, GuardDuty, and Security Hub.
- Experience securing software supply chains through SBOM generation, dependency provenance, artifact signing, and build-pipeline integration.
- Experience building or shaping security engineering capability in consultancy, programme delivery, or multi-client environments.
- Experience acting as a trusted technical adviser to senior client stakeholders and setting team ways of working in iterative delivery environments.
- Familiarity with structured threat modelling approaches including STRIDE, MITRE ATT&CK, and attack trees.
- Experience integrating SAST, SCA, dependency scanning, and container security tooling into CI/CD pipelines.
- OSCP, OSWE, equivalent offensive security credential, AWS/Azure/GCP security specialty certification, or CKS is desirable but not mandatory; equivalent experience is considered.
Benefits
- 30 days of paid annual leave.
- Flexible working hours.
- Flexible parental leave options.
- Part-time remote working for all staff.
- Flexible benefits platform including a Smart Tech scheme, Cycle to Work scheme, and individual benefits allowance applicable to a healthcare cash plan or pension plan.
- Paid counselling plus financial and legal advice.
- Optional social and wellbeing events.
- Monday-to-Friday standard hours, with occasional agreed work outside normal hours for release or change windows, planned maintenance, or client operating hours.
- Made Tech sponsors attainment of recognised cyber certifications for staff in scope.
Tech Stack
Categories
About Made Tech
Made Tech designs, builds, and operates digital services for the UK public sector, including central government, local authorities, and the NHS. Its consulting-led model covers agile delivery, cloud engineering, DevOps, and bespoke software across technologies like Ruby on Rails, Node.js, and Go. Founded in 2012 and headquartered in London, the company is publicly listed and has delivered services such as Homes for Ukraine and digital access to NHS support.