Cyber Security Controls Tester (Contractor)

Contract Type: Contract
Contract Length: Immediate start until February 2027
Security Clearance: Active SC Clearance required and must be verifiable

About the Opportunity

We are seeking an experienced Cyber Security Controls Tester to support a large-scale security assurance programme within a highly regulated environment. This is an excellent opportunity for a contractor with a strong background in security controls testing, assurance and risk management, particularly within central government or wider public sector environments.

Working remotely alongside security architects, risk teams and technical stakeholders, you will provide independent assurance over security controls, helping to ensure that controls are appropriately designed, implemented and operating effectively in line with recognised security standards and frameworks.

What You'll Be Doing

• Evaluating the effectiveness of security controls within the identified environment to ensure they meet the standards defined within supporting documentation, including High-Level Designs (HLDs), Low-Level Designs (LLDs) and Controls Catalogues.
• Testing controls against recognised security frameworks and standards, including ISO 27001, NIST CSF and NIST 800-53.
• Reviewing policies, procedures, network configurations, firewall rules, identity and access management controls, and other technical and procedural security controls.
• Applying recognised controls testing methodologies, including documentation reviews, walkthroughs, sampling and technical verification activities.
• Agreeing testing scope and plans with stakeholders, risk teams and security architects to ensure assurance activity addresses key security concerns.
• Assessing both the design effectiveness and operating effectiveness of implemented security controls.
• Providing pragmatic remediation guidance and recommendations to address identified control weaknesses.
• Supporting improvements to policies, processes and security controls to strengthen the overall security posture of services and environments.
• Maintaining clear documentation of testing activities, evidence collected, findings and remediation recommendations.
• Producing comprehensive assurance reports outlining security posture, findings, risks and recommendations.
• Presenting findings to technical and non-technical stakeholders and agreeing remediation actions where required.
• Working closely with risk and security architecture teams to ensure controls testing supports wider risk management and assurance objectives.

What We're Looking For

You will be a detail-oriented cyber security professional with experience assessing and validating security controls across complex technical environments. You'll be comfortable engaging with both technical and business stakeholders and have the ability to provide clear, evidence-based assurance and practical recommendations.

Essential Skills & Experience

• Demonstrable experience testing and evaluating the effectiveness of technical, procedural and physical security controls within complex environments.

• Strong working knowledge of security control frameworks including ISO 27001, NIST CSF, NIST 800-53 and CIS Controls.

• Experience conducting controls testing, assurance or audit activities against recognised security frameworks.

• Hands-on experience reviewing and testing:

  • Network configurations
  • Firewall rulesets
  • Identity and Access Management (IAM) controls
  • Encryption controls
  • Endpoint security controls

• Familiarity with security design and controls documentation including HLDs, LLDs and Controls Catalogues.

• Experience applying recognised testing methodologies, including documentation reviews, walkthroughs, sampling and evidence-based assurance activities.

• Strong understanding of relevant legislation and compliance requirements, including GDPR, PCI DSS and ICO guidance.

• Working knowledge of HMG and NCSC security policies, standards and guidance.

• Ability to produce clear, well-structured test plans, assurance reports and remediation recommendations.

• Strong stakeholder management and communication skills, with experience engaging risk teams, security architects and business stakeholders.

• Strong analytical and problem-solving skills, with a methodical approach to identifying, evidencing and reporting security control weaknesses.

Desirable Skills & Certifications

• CISA certification.
• ISO 27001 Lead Auditor or Lead Implementer certification.
• CRISC certification.
• CompTIA Security+ or similar security assurance-related certification.
• Experience working within central government or public sector environments.
• Experience supporting governance, risk and compliance (GRC) programmes.
• Exposure to cloud security assurance across Azure and AWS environments.
• Experience supporting IT Health Checks (ITHCs), penetration testing exercises or security accreditation activities.

Please note: Active SC Clearance is a mandatory requirement for this role and must be current and capable of being validated.