Role: Senior Threat Modeler
Location: London / Belfast
Start Date: ASAP
End Date: 6 Months
Daily Rate: Competitive Day Rate, Inside IR35
Payroll provider – Rockford Payroll Info for Contingent Workers – Rockford Pay
Responsibilities
- Threat Modeling using a documented process.
- Development of automation tools as required.
- Maintain a high standard of work in identifying threats and specifying mitigating controls.
- Attending to the lifecycle of identified threats and controls.
- Delivery of threat models and supporting tasks within existing timeframes.
- Provide feedback, support, and improvements to the existing threat modeling process.
- Present work to seniors, the team, and other technical teams.
- Train newer members of the team
- Supervise junior members of the team
- Run parts of our threat model service
- Work with little supervision to complete work
- Develop, test, and deploy secure and efficient Python-based applications, adhering to established SDLC processes and quality standards.
Certification Requirements
- You’re expected to have a professional level cloud certification (defined further below) from either AWS, GCP or Azure.
- You’re expected to have a vendors cloud security certification (defined further below) from either AWS, GCP or Azure.
- You’re expected to have a professional cyber-security certification (defined further below).
Technical skills
- You’re expected to have five or more years of experience in several of the following:
- IT experience minimum of 10 years with minimum of 4 years Cyber-Security/Information Security – must
- Threat Modeling (STRIDE, PASTA, Attack trees, tooling, Att&ck) – must.
- Identifying vulnerabilities using CWE or OWASP.
- Experience working in a cyber-security role - must.
- Security practices pertaining to authentication, authorization, logging/monitoring, encryption, infrastructure security, network/segmentation – must .
- Operating systems and their hardening.
- Development concepts (such as: CICD, Pipelines, SDLC) – must.
- Scripting languages, Infrastructure as Code (Terraform, CloudFormation) – must.
- Cloud Development Kit (CDK), GitOps.
- Operating in a DevOps / agile team structure.
- Jira or other ticketing systems.
- Understanding of docker/K8S/serverless/helm – must .
- Support or perform pen testing.
- Snowflake/MongoDB/Terraform Cloud/GitHub/Databricks.
- Design and review technical architectures.
- Strong proficiency in Programming Languages, with a preference for Python (asynchronous programming), and FastAPI (must).
- Unit Testing: Developing and executing unit tests using frameworks like Pytest to ensure code quality (must).
- Ensure all software platforms adhere to the client’s security standards and Software Development Life Cycle (SDLC) processes (must).
Essential Skills
- Analytical, diligence and attention to detail.
- Eagerness to research using vendor documentation.
- Create and maintain quality documentation.
- Experience of regulated environment.
- Adversary mindset.
- Work with diverse set of people and teams.
- Constant learner of new technologies and methodologies.
- Problem solver.
- Communication and collaboration skills.
- Builder of relationships across cross-functional teams.
Education
- Bachelor's degree in computer related field or equivalent work experience.
Professional level cloud certification
- AWS Certified Solutions Architect, AWS Certified DevOps Engineer
- Google Cloud Architect, Cloud Developer, Data Engineer, Network Engineer, and more
- Oracle Cloud Infrastructure Certified Architect Professional, Oracle Cloud Infrastructure HPC and Big Data Solutions Associate
- Microsoft Certified: Azure Solutions Architect Expert
Cloud security certification
- Google Professional Cloud Security Engineer
- Microsoft Certified Azure Security Engineer Associate
- AWS Certified Security - Specialty
Professional cyber-security certification
- ISACA Certified Information Security Manager (CISM)
- GIAC Certified Enterprise Defender (GCED), GIAC Certified Intrusion Analyst (GCIA), GIAC Open Source Intelligence (GOSI)
- ISC2 Certified Information Systems Security Professional (CISSP)
- CompTIA CASP+, CompTIA PenTest+
- Microsoft Certified: Identity and Access Administrator Associate