Security Assurance Lead

• Act as the primary Information Security point of contact for a portfolio of projects within the Sustainability & Business Change Programme (SBC), providing security consultancy that enables successful business delivery & security governance.
• Build trusted relationships with stakeholders across Technology and the wider business, offering clear, risk based security advice throughout the project lifecycle.
• Support Business Analysts and delivery teams in defining security activities, identifying security requirements and embedding Secure by Design principles from the earliest stages of delivery.
• Operate and continue improving the Information Security Front Door, helping establish a consistent and effective engagement model for accessing security services across the organisation.
• Facilitate threat modelling workshops, produce Data Flow Diagrams (DFDs) and carry out structured threat assessments using the STRIDE methodology.
• Conduct security assurance activities across new and existing services, including architecture and design reviews, configuration assessments, security hardening reviews and production security assessments.
• Prioritising, designing and then resolving the findings of threat models and security assurance assessments. 
• Coordinate penetration testing activities, review findings with technical teams and ensure remediation plans are agreed, prioritised and tracked.
• Assess implementation plans, technical designs and solution architectures, providing practical recommendations that balance security, delivery and operational requirements.
• Work with AppSec, CloudSec, platform engineering and delivery teams where initiatives impact products, AWS, Azure services, helping identify app and cloud security considerations and ensuring specialist expertise is engaged where required.
• Collaborate with Security Operations, Identity, IT Continuity and other Information Security teams to deliver consistent security outcomes across programmes and operational services.
• Identify, assess and prioritise security risks arising from reviews, threat modelling and assurance activities, ensuring they are managed appropriately through to resolution.
• Promote security awareness and encourage secure engineering practices, helping delivery teams understand security requirements without creating unnecessary barriers.
• Contribute to the ongoing improvement of security standards, patterns, guidance and processes, ensuring they remain aligned with industry best practice and organisational objectives.
• Mentor colleagues where appropriate and help improve the wider Security Business Consulting capability.
  

• Proven experience working in cyber security, with experience in security consulting, application security, product security or security engineering.
• Experience partnering with delivery teams to provide security guidance throughout project and programme lifecycles.
• Excellent communication and stakeholder management skills, with the ability to build credibility and influence both technical and business audiences at all levels.
• The ability to balance competing priorities while working across multiple projects and initiatives.
• Experience conducting threat modelling, producing Data Flow iagrams and applying methodologies such as STRIDE.
• Experience carrying out security assurance activities, including solution reviews, security assessments, configuration reviews and security hardening.
• Experience coordinating penetration testing activities and managing the remediation of identified vulnerabilities.
• A good understanding of Secure by Design principles and the ability to apply them throughout solution delivery.
• Experience identifying, assessing and prioritising security risks, providing pragmatic recommendations that align with business objectives and the organisation's risk appetite.
• Good working knowledge of recognised security frameworks and standards such as NIST or ISO27001, along with industry best practice.
• Experience working with cloud technologies, particularly AWS and Azure, and a good understanding of cloud native security controls and services.
• Experience working alongside engineering teams to design and implement security controls and improvements across applications, infrastructure and cloud environments.
• An understanding of CI/CD pipelines, secure software delivery practices and modern application Œment approaches.
• A collaborative approach and a “can-do” attitude with a willingness to share knowledge, mentor colleagues and contribute to the continual improvement of the Information Security function.
• A recognised security certification such as CISSP would be advantageous, although equivalent experience and a commitment to continued professional development are equally valued.

Motability Operations is a unique organisation, virtually one of a kind. We combine a strong sense of purpose with a real commercial edge to ensure we provide the best possible worry-free mobility solutions to over 800,000 customers and their families across the UK. Customers exchange their higher rate mobility allowance to lease a range of affordable vehicles (cars, wheelchair accessible vehicles, scooters, and powered wheelchairs) with insurance, maintenance and breakdown assistance included. We are the largest car fleet operator in the UK (purchasing around 10% of all the new cars sold in the UK) and work with a network of around 5,000 car dealers and all the major manufacturers. We pride ourselves on delivering outstanding customer service, achieving an independently verified customer satisfaction rating of 9.8 out of 10.

Our values are at the heart of everything we do. They represent ambition, and we look for our people to live and breathe them every day:

• We find solutions
• We drive change
• We care

We operate hybrid working across the organisation where we split our time between working on-site at our offices, and at home, remotely within the UK. We believe hybrid working achieves a good work/life balance for our colleagues, allowing us to connect with each other, collaborate on important work, and perform together to deliver for our customers.  It allows us to have the flexibility to work remotely up to 2-days per week whilst also using the great office spaces we have available.

As a Motability Operations team member, you can expect:

• An annual discretionary bonus
• 15% non-contributory pension (9% non-contributory pension during probation period)
• Life assurance at 4 times your basic salary to give you peace of mind that your loved ones will receive some financial help
• Employee Discount Scheme with a huge number of retailers and an app to save on the go
• Discounted Electric/Hybrid Car Salary Sacrifice Scheme
• Access to the Cycle to Work Scheme (we have showers, changing rooms and secure bike sheds on site)

As well as financial benefits, our staff's health and well-being are very important to us, so we also offer:

• 28 days annual leave with option to purchase and sell days
• Funded Private Medical Insurance cover
• Critical illness insurance
• Free access to healthcare apps, such as Peppy, Unmind, Aviva Digital GP
• Funded health screening for over 50s
• 1 day per year to volunteer – Staff can support a local charity or do a sponsored event whilst being paid for it
• Access to our fully accessible company allotment – Where we grow our own produce for local charitable organisations
• Access to Prayer room and quiet spaces whilst working in the office

We also understand that not everyone is the same so offer several voluntary benefits that you can select outside the core package, these include;

• Dental Insurance
• Health and cancer screenings for you and your partner 
• Discounted gym memberships
• Charitable giving

At Motability Operations, we believe in building a diverse workforce, where our people are empowered to attend work as their true selves, and we encourage people from all backgrounds to apply.  We want to sustain a culture that nurtures, where employees are free to flourish and where they’re rewarded equally, regardless of race, nationality or ethnic origin, sexual orientation, age, disability, or gender.

We pride ourselves on being an inclusive employer and as such, all our offices provide first rate disability access. With our hybrid working environment, we do our best to accommodate part-time and flexible working requests where possible, building on our culture of trust, empowerment, and flexibility.

Please note, Motability Operations reserves the right to bring forward the closing date of any of its job vacancies if we receive a suitable number of quality applications from which to make a shortlist. Therefore, we recommend that you apply as soon as possible rather than wait until the published closing date.