Lead Security by Design Consultant (Defence Aviation)

Location: Yeovil, Somerset, England; minimum 3 days onsite per week, increasing when programme requirements demand

Salary: £120.37 per hour; 12-month contract; outside IR35

Company

hirify.global is recruiting for a major defence aviation programme.

What you will do

• Lead Security Management Plans, security cases, assurance artefacts, and cyber security risk reports.
• Translate customer security requirements into actionable plans, statements of work, controls, and engineering lifecycle activities.
• Conduct technical security risk assessments, threat modelling, and vulnerability analysis, defining mitigations.
• Guide product engineers, system architects, and developers across software, firmware, and electronic hardware security.
• Scope and manage security verification, validation, remediation, technical risks, delivery risks, and customer relationships.
• Deliver security outputs to agreed time, cost, and quality requirements and contribute to security working groups.

Requirements

• Sole British citizenship and active SC clearance are required.
• Experience delivering security outcomes within defence, including defence aviation.
• Strong knowledge of MOD accreditation and Secure by Design processes, including ISN2023/09.
• Experience with high-integrity software and embedding secure software design into established development lifecycles.
• Practical experience with Defence Standards 05-138 and 05-139 and NIST SP 800-30, SP 800-37, and SP 800-53.
• Supply chain security risk management experience using NIST SP 800-161 or ISO 28000.
• Experience developing and reviewing system security designs and translating security requirements into system or process controls.
• Strong stakeholder management and communication skills, with the ability to work independently and guide technical teams.
• A relevant degree in cyber security, systems engineering, or software engineering, or comparable professional experience; at least two recognised cyber security certifications and/or relevant chartered status, such as CISSP, CISM, CASP/SecurityX, or ChCSP.

Nice to have

• Engineering lifecycle reviews, including SRR, PDR, CDR, and TRR.
• Knowledge of ARP4754A/ARP4761 and their relationship with security.
• Knowledge of RTCA DO-326A/B, DO-355A, and DO-356A.

Culture & Benefits

• Hybrid arrangement requiring at least 3 onsite days per week in Yeovil, with increased attendance when programme requirements demand.
• 12-month contract engagement outside IR35.
• Work alongside security consultants, engineers, and product specialists across the engineering lifecycle.

Hiring process

• Submit a CV outlining relevant defence aviation and security engineering experience.