> Markdown version of [/jobs/ext/2436225-senior-associate-cloud-and-platform-assurance-specialist](https://www.wearedevelopers.com/jobs/ext/2436225-senior-associate-cloud-and-platform-assurance-specialist). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Associate - Cloud and Platform Assurance Specialist - **Company:** Financial Conduct Authority - **Location:** London, UK - **Experience:** Expert - **Salary:** £53,000.0 - £69,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Access, Amazon Web Services, Microsoft Azure, Software as a Service, Cloud Computing, Cloud Computing Security, Cloud Engineering, Configuration Management, Cyber Security, Identity and Access Management, Network Security, Cloud Services, Material Design, Software Engineering, Data Streaming, Software Vulnerability Management, Data Logging, Cloud Platform System, CIS Benchmarks - **Published:** August 11, 2026 - **Apply:** https://uk.indeed.com/viewjob?jk=830ec17ef500787a ## About the Role * Strong technical security knowledge of at least one major public-cloud platform, ideally Microsoft Azure, with practical experience across identity and access management, privileged access, network security, workload and data protection, configuration governance, logging and monitoring, vulnerability management, and resilience. * Demonstrable experience independently assessing cloud architectures and security controls, including evaluating control design, implementation, and operating effectiveness, while remaining independent from ownership or implementation of the controls being assessed. * Experience leading or conducting end-to-end, risk-based cloud security assurance activities, including scoping, evidence gathering, control testing, reporting findings, making remediation recommendations, and validating that actions have been completed effectively. * Practical experience using or assuring CSPM, CNAPP, SSPM or comparable cloud security posture and exposure-management capabilities, including validating findings, assessing coverage, identifying root causes, and distinguishing isolated issues from wider systemic control weaknesses. * Strong communication and stakeholder-management skills, with the ability to translate technical issues into clear business and security risks, produce concise assurance conclusions and constructively challenge technical teams, control owners, and senior stakeholders Essential: * Experience evaluating cloud security baselines, policies, guardrails, exceptions, and compensating controls, including identifying gaps in configuration governance and control implementation. * Strong knowledge of recognised security and assurance frameworks, with experience applying standards such as NCSC guidance, the NIST Cybersecurity Framework, CIS Benchmarks, and the CSA Cloud Controls Matrix. * Experience applying cloud security and assurance principles across Azure, AWS, SaaS, hybrid or other cloud-hosted services, including identifying control inconsistencies, shared-responsibility gaps and duplicated or unclear ownership between environments. * Experience assessing material cloud exposures, including attack paths, excessive permissions, toxic combinations, and risks introduced through cloud-native delivery, infrastructure as code, CI/CD pipelines, containers, or platform-engineering controls. * Experience working in a regulated or similarly complex environment, with the ability to contribute to cloud-assurance methodologies and produce meaningful metrics, KPIs or KRIs covering control effectiveness, security exposure, assurance coverage, and remediation progress ## Description We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you'll play a key part in protecting consumers, driving economic growth, and shaping the future of UK finance services., This role is positioned at Senior Associate level and is suited to an experienced security professional with solid technical knowledge of at least one major public-cloud platform, ideally Microsoft Azure and the ability to apply assurance principles consistently across Azure, AWS, SaaS and other cloud-hosted services. You will combine architectural understanding with an assurance-led mindset, independently reviewing control design and effectiveness, validating security findings and helping platform and engineering teams make proportionate, risk-based remediation decisions. The position will remain independent from the ownership and implementation of the controls it assesses. Although cloud assurance will be the principal focus, the role may also support assurance across identity, network, endpoint, secure software development and wider platform controls where these intersect with cloud services. Role responsibilities * Acting as a cloud assurance SME, providing self-directed feedback and guidance on cloud architecture, control design, implementation and effectiveness, while reviewing cloud architectures, data flows, trust boundaries and control dependencies to identify material design weaknesses, systemic control gaps and unmanaged exposure * Supporting and contributing to risk-based assurance reviews across public-cloud and SaaS services, with particular emphasis on Microsoft Azure, while applying consistent, cloud-agnostic assurance principles. * Providing assurance over CSPM, CNAPP, SSPM and related exposure-management capabilities, including assessing coverage, configuration, findings, exceptions, risk prioritisation and remediation outcomes, and validating whether identified exposures represent genuine risk through root-cause analysis and assessment of underlying control effectiveness. * Assessing cloud security controls, baselines, policies and guardrails across identity and privileged access, network security, workload protection, configuration management, data protection, logging and monitoring, vulnerability management and resilience, ensuring appropriate and consistent control coverage. * Working collaboratively with cloud platform owners, engineering teams, security teams and service owners to agree pragmatic remediation, validate compensating controls and support proportionate risk-based decisions. * Supporting assurance activities across broader cyber security domains, including identity, network, endpoint security and secure software delivery controls, where these underpin cloud services or cloud-hosted workloads * Producing clear, evidence-based assurance conclusions, metrics, KPIs and KRIs for management and risk forums, covering control effectiveness, exposure, remediation and residual risk * Contributing to the continuous improvement of cloud assurance methodologies, standards, testing approaches and tooling, aligned with relevant NCSC, NIST, CIS and CSA guidance * Monitoring developments in cloud technologies, threat patterns and security practices, assessing their relevance to the FCA's cloud risk profile and assurance approach. ## Related Videos - [Python-Based Data Streaming Pipelines Within Minutes](https://www.wearedevelopers.com/videos/1233-python-based-data-streaming-pipelines-within-minutes) - [A practical guide to writing secure Dockerfiles](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles) - [Crypto-secure Data Management with In-Database Blockchain](https://www.wearedevelopers.com/videos/632-crypto-secure-data-management-with-in-database-blockchain) - [Hacking MSSQL on Cloud. All of them. How I became sysadmin on Azure, AWS, GCP and Alibaba.](https://www.wearedevelopers.com/videos/100339-hacking-mssql-on-cloud-all-of-them-how-i-became-sysadmin-on-azure-aws-gcp-and-alibaba) - [Why and when should we consider Stream Processing frameworks in our solutions](https://www.wearedevelopers.com/videos/1085-why-and-when-should-we-consider-stream-processing-frameworks-in-our-solutions) - [OPA for the cloud natives](https://www.wearedevelopers.com/videos/713-opa-for-the-cloud-natives) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [7 Cloud Computing Trends Coming in 2025 for Developers](https://www.wearedevelopers.com/magazine/412-7-cloud-computing-trends-coming-in-2025-for-developers) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023)