Information Security Technical Assurance Lead

Job Title: Cyber Security Assurance Specialist (Application Security)
Client: Urenco
Rate: £700 per day
Location: Hybrid – Minimum 2 days per week in Paddington, London
Clearance: Active SC Clearance required

About the Client

Urenco is a world leader in the enrichment of uranium for use in the civil nuclear industry. Operating across the United Kingdom, United States, Netherlands, and Germany, Urenco plays a critical role in enabling the safe, sustainable use of nuclear technology worldwide.

The Group CISO function is responsible for continuously developing and enhancing Urenco’s cyber security portfolio to protect the organisation, its customers, and the public. The CISO team is structured across three core areas:

• Governance, Risk & Compliance (GRC)
• Operational Technology (OT) Cyber & Cyber Assurance
• Threat Defence

This opportunity sits within the Cyber Assurance Team, reporting directly to the Head of Cyber Security Assurance.

Role Overview

We are seeking an experienced Cyber Security Assurance Specialist with a strong focus on application security across both on-premises and cloud environments.

You will play a key role in improving cyber security maturity across the organisation by providing assurance over security designs, assessing risk, and developing application security standards and policies. The role requires close collaboration with IT, Information Security, and business stakeholders, translating business requirements into secure, practical solutions.

This is a highly visible position requiring strong communication skills, sound business judgement, and the ability to operate effectively in agile delivery environments.

Key Responsibilities

1. Security Design & Solution Assurance

• Review and assure technical designs against security policies and standards
• Identify security design gaps and recommend appropriate control improvements
• Author and review high-quality security documentation
• Provide security oversight for both on-premises and cloud-based solutions
• Act as a trusted advisor and security advocate across the business
• Communicate effectively with stakeholders to embed secure-by-design principles

2. Security Risk Assessment & Control Assurance

• Produce formal security risk assessments in collaboration with GRC, architects, and IT teams
• Define and agree risk mitigations and compensating controls
• Assure implementation and effectiveness of technical controls
• Translate business strategy into secure architecture guidance
• Conduct supplier assurance across on-premises, cloud, and hybrid services

3. Security Standards, Policies & Governance

• Develop and maintain application security policies, standards, and guidelines
• Align security frameworks with broader business strategy
• Track emerging security practices and ensure standards remain current
• Support the continuous improvement of cyber security maturity

Essential Experience

• Minimum 5 years’ experience in Information Security Assurance with a focus on application security
• Experience working in a global organisation
• Strong knowledge of regulatory compliance and security frameworks such as:
• ISO 27000 series
• NIST SP 800 series
• NIST Cyber Security Framework
• Experience in:
• Secure application design and review
• Cloud security assurance
• Penetration testing and vulnerability management
• Supplier security assurance

Desirable Experience

• Knowledge of nuclear industry regulations across the UK, US, Netherlands, and Germany
• Understanding of government information classifications
• Experience in OT security environments

Technical Knowledge

Strong understanding of security controls across multiple asset types including data, networks, devices, and users, covering:

• Software Asset Inventory & Control
• Data Protection
• Secure Configuration Management
• Continuous Vulnerability Management
• Audit Log Management
• Malware Defences
• Disaster Recovery
• Service Provider Security Management
• Application Security & Penetration Testing

Qualifications & Certifications

• Degree (BS/MS) in Computer Science, Information Security, or equivalent experience
• Relevant certifications such as:
• CISSP
• CISA
• CSSLP
• OWASP ASVS / OWASP Top 10
• GIAC (GWAPT, GCSA)
• CASE
• Certified DevSecOps Professional

Key Competencies

• Strong business acumen with ability to align security to organisational objectives
• Adaptable and responsive to changing risk landscapes
• Excellent written and verbal communication skills
• Strong analytical and decision-making capability
• Team-oriented with experience working across diverse stakeholders
• Self-motivated with a sense of urgency and delivery focus
• Organised and able to manage multiple priorities

Additional Information

• Hybrid working model – minimum 2 days per week onsite in Paddington
• Occasional travel may be required
• Active SC clearance is mandatory