Cyber Security Controls Tester (Contractor)

Location: Fully Remote (UK)
Contract Type: Contract
Contract Length: Immediate start until February 2027
Security Clearance: Active SC Clearance required and must be verifiable

About the Opportunity

What You'll Be Doing

• Evaluating the effectiveness of security controls within the identified environment to ensure they meet the standards defined within supporting documentation, including High-Level Designs (HLDs), Low-Level Designs (LLDs) and Controls Catalogues.

• Testing controls against recognised security frameworks and standards, including ISO 27001, NIST CSF and NIST 800-53.

• Reviewing policies, procedures, network configurations, firewall rules, identity and access management controls, and other technical and procedural security controls.

• Applying recognised controls testing methodologies, including documentation reviews, walkthroughs, sampling and technical verification activities.

• Agreeing testing scope and plans with stakeholders, risk teams and security architects to ensure assurance activity addresses key security concerns.

• Assessing both the design effectiveness and operating effectiveness of implemented security controls.

• Providing pragmatic remediation guidance and recommendations to address identified control weaknesses.

• Supporting improvements to policies, processes and security controls to strengthen the overall security posture of services and environments.

• Maintaining clear documentation of testing activities, evidence collected, findings and remediation recommendations.

• Producing comprehensive assurance reports outlining security posture, findings, risks and recommendations.

• Presenting findings to technical and non-technical stakeholders and agreeing remediation actions where required.

• Working closely with risk and security architecture teams to ensure controls testing supports wider risk management and assurance objectives.

What We're Looking For

Essential Skills & Experience

• Demonstrable experience testing and evaluating the effectiveness of technical, procedural and physical security controls within complex environments.

• Strong working knowledge of security control frameworks including ISO 27001, NIST CSF, NIST 800-53 and CIS Controls.

• Experience conducting controls testing, assurance or audit activities against recognised security frameworks.

• Hands-on experience reviewing and testing:

  • Network configurations

  • Firewall rulesets

  • Identity and Access Management (IAM) controls

  • Encryption controls

  • Endpoint security controls

• Familiarity with security design and controls documentation including HLDs, LLDs and Controls Catalogues.

• Experience applying recognised testing methodologies, including documentation reviews, walkthroughs, sampling and evidence-based assurance activities.

• Strong understanding of relevant legislation and compliance requirements, including GDPR, PCI DSS and ICO guidance.

• Working knowledge of HMG and NCSC security policies, standards and guidance.

• Ability to produce clear, well-structured test plans, assurance reports and remediation recommendations.

• Strong stakeholder management and communication skills, with experience engaging risk teams, security architects and business stakeholders.

• Strong analytical and problem-solving skills, with a methodical approach to identifying, evidencing and reporting security control weaknesses.

Desirable Skills & Certifications

• CISA certification.

• ISO 27001 Lead Auditor or Lead Implementer certification.

• CRISC certification.

• CompTIA Security+ or similar security assurance-related certification.

• Experience working within central government or public sector environments.

• Experience supporting governance, risk and compliance (GRC) programmes.

• Exposure to cloud security assurance across Azure and AWS environments.

• Experience supporting IT Health Checks (ITHCs), penetration testing exercises or security accreditation activities.