Principal Security Consultant

Key Responsibilities

• Operate as senior cyber architect and SME within the programme's structured operating model — actively engaged from requirements capture through to BAU handover, owning Definition-of-Done evidence at every gate.
• Break down each Master Programme Plan activity into discrete People / Process / Technology tasks viewed through a cyber security lens — define the validation and assurance criteria, embed them as DoD acceptance criteria, and evidence them before status can advance.
• Requirements: author threat model v1, control intent statement, and compensating controls; validate requirements against current operational baseline and monitoring posture.
• Architecture (LEAD): author security architecture, safeguard mapping, and trust boundaries; approve the threat model; chair Security Council review of the architecture pack.
• Design (LEAD): approve detailed security design, evidence template, and telemetry specification; validate operational controls in the design; confirm evidence-capture feasibility before build commences.
• Build: run periodic build-vs-design reviews, architecture drift checks, and re-approve changes; configure operational controls, prepare security testing, support agent rollout, validate log feeds.
• Test (LEAD): sign off that the security architecture is proven by test evidence; revalidate the threat model; lead security testing, penetration testing, control validation, and evidence pack creation.
• Deploy: provide production architecture sign-off; confirm final control mapping in Continuous Control Monitoring (CCM); run live security validation, monitoring tuning, alert calibration, and IR playbook readiness.
• Hyper-care (LEAD): address security-architecture defects, approve in-warranty changes; lead control monitoring and tuning; produce security evidence and establish Key Risk Indicator (KRI) baselines.
• Handover: hand architecture over to the Security Council, lodge the final threat model, ensure the CCM tile goes live; transition operational controls to L1 SOC operations with a complete evidence pack to external assurance.
• Liaise directly with external assurance providers on threat-model defensibility, control effectiveness, and evidence chain across the CIS Controls v8.1 IG3 scope.
• Chair or jointly chair the Security Council review at the architecture stage gate; participate in TDA decisions at the design stage gate.

CIS Controls Deliverables

• Threat model and control intent per in-scope safeguard, lodged with Security Council
• Detailed security design + evidence template + telemetry specification at the design stage gate
• Security testing pack + penetration test results + evidence pack at the test stage gate
• Production security architecture sign-off + CCM mapping confirmation at deployment
• KRI baselines and control-monitoring evidence at hyper-care
• Final security architecture and threat model lodged with the Security Council at handover
• External assurance evidence pack supporting each IG maturity gate (IG1 → IG2 → IG3 FINAL)
• Definition-of-Done evidence at every stage gate from requirements through handover

Tech Stack Engagement

• Threat modelling: STRIDE, MITRE ATT&CK, OWASP Threat Dragon, Microsoft Threat Modeling Tool
• SIEM and log analytics: Microsoft Sentinel + Cribl + Elastic
• Endpoint security: CrowdStrike + Defender Endpoint + Gem
• Email & web security: Defender for O365 + Abnormal + Zscaler
• Vulnerability management: Qualys + BMC Helix VR
• Application security: Semgrep SAST + Snyk SCA + Burp Suite Enterprise + Akamai WAF
• Operational cyber and GRC: BMC Helix SecOps + Remedyforce GRC
• Penetration testing: Burp Suite Professional, Metasploit, Nmap, OWASP ZAP
• Incident response playbook and runbook tooling
• monday.com — programme operating-model tool used for the architect and SME tracks

People · Process · Technology Outcomes

• People: Led security engineering across the programme; senior peer to Security Solution Architects, Cyber Operations, and the MSSP L1 SOC interface.
• Process: Embedded structured operating-model discipline into every security validation and assurance step; Definition-of-Done evidence at every gate, no exceptions.
• Technology: Delivered secure-by-design as built; personally signed off every architecture and operational handover, with an audit-traceable evidence chain from threat model to live monitoring.

Essential Experience & Skills

• 12+ years cyber engineering and security architecture experience at enterprise scale.
• 5+ years hands-on security design AND validation — comfortable both as architect (design authority) and as engineer (hands-on implementer).
• Direct experience with CIS Controls v8.1, NIST CSF, ISO 27001 / 27002 control frameworks.
• Threat modelling at scale — proven authorship using STRIDE, MITRE ATT&CK, OWASP — across multiple in-scope controls.
• Hands-on penetration testing, security testing, and control validation track record.
• Workflow discipline — operates comfortably within Definition-of-Done, evidence-at-gate frameworks.
• Exceptional executive-level interactions, presentation, and engagement — proven ability to influence CISO, Security Council, External Assurance, and cross-functional senior stakeholders across Procurement, Architecture, and Technology heads.
• Retail or large dispersed-estate enterprise experience strongly preferred.

Tooling & Methodology Proficiency

Essential

• Hands-on with leading enterprise PM tools — Jira, Azure DevOps, MS Project, monday.com, or equivalent — and willing to adopt monday.com (the programme's tool) on the job at senior architect and SME level.
• End-to-end Agile delivery — Scrum / Kanban — combined with DevSecOps deep hands-on practice (security gates embedded in CI/CD).
• SAFe PI Planning participation as the cyber security representative.
• Executive-grade MS PowerPoint — Security Council paper authoring, threat-model presentation, design narrative for Programme Board.
• Advanced dashboards and modelling — one or more of Advanced MS Excel, PowerBI, Python, or Copilot — for KRI baselines, control-effectiveness analytics, and risk reporting.
• Budgeting awareness — security control cost shaping and total-cost-of-ownership analysis.

Desirable

• Direct hands-on monday.com experience at senior architect / SME level.
• Practical DevSecOps Foundation or SANS GIAC GCSA.
• SABSA for Architects.
• Microsoft Threat Modeling Tool / OWASP Threat Dragon authorship.
• PowerBI Data Analyst (PL-300) for KRI and risk dashboards.

Certifications

Essential

• CISSP (Certified Information Systems Security Professional)
• One of: CISM, CISA, CCSP, SABSA Practitioner, or CRISC
• One penetration-testing certification: OSCP, GIAC GPEN, or CEH (or equivalent demonstrable experience)

Desirable

• CompTIA CASP+ or PenTest+
• GIAC GCIH, GCFA, GCIA, or GREM
• AWS Security Specialty or Azure Security Engineer / Security Architect Expert
• BMC Helix Certified Professional (SecOps)
• ISO 27001 Lead Auditor or Lead Implementer
• TOGAF 9.2 awareness

Key Competencies

• Senior technical authority — credibility at architect and engineer level simultaneously
• Security Council gravitas
• Threat-modelling craftsmanship — STRIDE, MITRE ATT&CK, OWASP fluency
• Workflow discipline — Definition-of-Done evidence at every gate is non-negotiable
• Executive-level engagement with CISO, Security Council, External Assurance, and senior cross-functional stakeholders