Security Operations Officer – Security Assessment & Assurance

Overview

Role Overview

Security Assurance

• Lead enterprise security assessments across technology platforms.
• Perform architecture reviews, vulnerability assessments, and security control validation.
• Develop and maintain a structured security assurance framework.
• Track remediation activities from identification through validation.
• Present technical findings in clear business risk terms.

Application, Cloud & Infrastructure Security

• Assess web applications, APIs, mobile platforms, cloud environments, infrastructure, and container technologies.
• Identify authentication weaknesses, privilege escalation risks, business logic flaws, and other advanced attack vectors.
• Validate secure architectures and cloud security controls.
• Support Secure SDLC and DevSecOps initiatives.

Configuration & Hardening

• Develop secure configuration baselines across:
• Operating systems
• Network infrastructure
• Databases
• Cloud services
• Identity platforms
• Security technologies
• Align hardening standards with recognised industry best practices.
• Implement continuous configuration compliance monitoring.
• Detect configuration drift and coordinate remediation with engineering teams.

Security Architecture

• Conduct security design and architecture reviews.
• Perform threat modelling exercises.
• Ensure solutions align with enterprise security architecture and Zero Trust principles.

Third-Party Security & Resilience

• Assess third-party suppliers and externally hosted services.
• Validate encryption, data protection, and privacy controls.
• Support resilience testing, red team exercises, and incident response simulations.
• Participate in security reviews of operational technology environments where applicable.

Governance & Reporting

• Support security audits and compliance activities.
• Produce security metrics, KPIs, and executive reporting.
• Ensure continued alignment with recognised security frameworks and standards.

Required Experience

• 8+ years of Information Security experience.
• Extensive experience performing security assessments and assurance activities.
• Strong knowledge of application, cloud, infrastructure, and identity security.
• Hands-on experience with vulnerability management and security architecture reviews.
• Experience implementing secure configuration baselines and system hardening.
• Excellent communication skills with both technical and business stakeholders.

Technical Skills

• Security assessments
• Application Security
• API Security
• Mobile Security
• Cloud Security
• Vulnerability Management
• Penetration Testing
• Security Architecture
• Threat Modelling
• DevSecOps

• Secure Configuration Management

• Zero Trust

Preferred Certifications

• Offensive Security certifications
• CISSP
• Cloud Security certifications
• Industrial Cyber Security certifications (desirable)