Cyber Security Policy & Standards Consultant

You know how to turn a complex security requirement into a standard people can implement and test. You’ve personally written cyber security policies and technical standards, and you’re ready to take ownership of a standards refresh within a UK financial services organisation. With the previous policy lead having moved internally, you’ll step into an established function where your writing and judgement will directly shape how security requirements are understood, applied and assessed.

Own the work from assessment to finished draft You’ll work with an existing, NIST-aligned standards suite, deciding where a light refresh is enough and where a more substantial rewrite is needed. Working with technical specialists across areas such as user access management, cryptographic key management, firewalls and Privileged Access Management, you’ll challenge outdated content, resolve gaps and produce clear, usable requirements. You’ll own the drafting and redrafting, bringing completed documents through stakeholder review and approval. Your standards will give colleagues a clear basis for implementing controls and testing compliance.

Your authorship experience is essential

You must have personally authored technical cyber security standards, including writing from scratch. Much of this assignment involves refreshing existing documentation, but you’ll need the depth of experience to create a new standard where required. Policy and standards writing should have been a substantial focus of your previous work. You’ll be able to explain:

• Which documents you personally wrote and the technical requirements they covered.
• How you worked with specialists to establish and challenge those requirements.
• How you made the finished standards specific enough to implement and test.

You’ll bring broad cyber security knowledge and experience translating NIST-aligned controls into practical documentation within a complex organisation.

You ll bring direct experience of assessing, authoring and refreshing technical cyber security standards across multiple domains, including areas such as:

• Identity and access: user authentication, user access management and privileged access management.
• Infrastructure security: firewalls, network security, endpoint protection, cloud security and system communications.
• Cryptography: cryptographic controls and key and certificate management.
• Security operations: audit logging and monitoring, incident management, and vulnerability and patch management.
• Data and technology governance: information classification, data loss prevention, data residency, secure disposal, asset management, BYOD, Shadow IT, secure development and third-party assurance.

You don’t need to have authored every standard listed, but you must demonstrate substantial personal ownership of technical standards across several of these areas. You ll be comfortable assessing existing documents, challenging technical gaps and producing finished drafts with clear requirements that teams can implement and assurance colleagues can test.

This could suit a former Cyber Security Standards Lead, Technical Security Policy Consultant, Security Controls Consultant and Security Assurance Consultant, Cyber Security Policy Lead, a Security Standards Lead or a consultant with a strong track record of independently delivering this work.