> Markdown version of [/jobs/ext/4642258-lead-security-by-design-consultant](https://www.wearedevelopers.com/jobs/ext/4642258-lead-security-by-design-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Security by Design Consultant

- **Company:** Morson Group
- **Location:** Yeovil, United Kingdom
- **Experience:** Expert
- **Salary:** £250,370
- **Contract:** Temporary contract
- **Skills:** Cyber Security, Firmware, Software Engineering
- **Published:** November 9, 2026
- **Apply:** https://www.morson.com/jobs/42381/apply

## About the Role

* Experience delivering security outcomes within defence, including experience in defence aviation.
 * Strong knowledge of MOD accreditation and Secure by Design processes, including ISN2023/09.
 * Experience with high-integrity software and embedding secure software design into established development lifecycles.
 * Practical application of Defence Standards 05-138 and 05-139, alongside NIST guidance such as SP 800-30, 800-37 and 800-53.
 * Supply chain security risk management experience using NIST SP 800-161 or ISO 28000.
 * Experience developing and reviewing system security designs and translating security requirements into system or process controls.
 * Strong stakeholder management and communication skills, with the ability to work independently and guide technical teams.
 * A relevant degree in cyber security, systems or software engineering, or comparable professional experience.
 * At least two recognised cyber security certifications and/or relevant chartered status, such as CISSP, CISM, CASP/SecurityX or ChCSP.

Desirable experience

 * Engineering lifecycle reviews, including SRR, PDR, CDR and TRR.
 * ARP4754A/ARP4761 and their relationship with security.
 * RTCA DO-326A/B, DO-355A and DO-356A.

## Description

* Lead the production and maintenance of Security Management Plans, security cases, assurance artefacts and cyber security risk reports.
 * Translate customer security requirements into actionable plans, statements of work and engineering lifecycle activities.
 * Conduct technical security risk assessments, threat modelling and vulnerability analysis, identifying appropriate mitigations.
 * Provide security guidance to product engineers, system architects and developers across software, firmware and electronic hardware.
 * Scope and manage security verification and validation activities and associated remediation plans.
 * Manage technical and delivery risks, customer relationships and contributions to security working groups.
 * Deliver agreed security outputs to time, cost and quality requirements.