Security Analyst

This Project drives the Royal Navy’s capability by delivering digital solutions that increase operational efficiency, effectiveness, and availability. Operating across Official and Secret domains, from shore to sea. 

Data & Navy Application (DNA) provides end-to-end support for bespoke and procured applications. 

Security Analyst

We are seeking a proactive and detail-oriented Security Analyst to join our team in a fast-paced software house environment. In this role, your primary focus will be clearing the backlog of Application, Governance and Assurance Pack (AGAPs) required under our Security by Design (SbD) framework for all products owned by TLSE and Live Services.

You will act as the key facilitator and bridge across multiple technical functions; gathering, synthesising, and validating architectural, infrastructure, and operational security data. Your work will ensure that the products across our portfolio are fully documented, assessed, and aligned with security standards and governance policies.

Key Responsibilities

• Systematically review, prioritise, and clear the backlog of AGAP assessments required across the portfolio of TLSE-owned software products.
• Proactively collaborate with TLSE, Live Services, Hosting Services, the Tech Office, and Software Developers to extract, verify, and consolidate technical security data needed to populate each AGAP.
• Identify, assess and document product architectures, data flows and hosting models, validating alignment with established SbD guidance and escalating issues where required.
• Identify missing security controls, unmitigated risks, assurance gaps or architectural concerns and provide recommendations, escalating findings to relevant stakeholders where required.
• Maintain complete, audit-ready AGAP documentation within central security repositories and track remediation actions to completion.
• Gather insights from the review process to provide constructive feedback to the Tech Office on streamlining SbD workflows and AGAP templates.
• Conduct application assurance reviews.
• Analyse existing assurance documentation and evidence.
• Identify gaps against Secure by Design requirements.
• Work with Service Owners, Product Teams and SMEs to discover, capture and document application, infrastructure, security and operational information where existing documentation is incomplete, outdated or unavailable.
• Gather, analyse and organise evidence required to support AGAP completion, assurance reviews and Secure by Design activities.
• Maintain assurance evidence repositories, track remediation actions and support governance and audit activities.
• Document findings, risks and remediation activities.
• Support tracking and reporting of assurance status across the portfolio.

Must haves:

• 3+ years in information security, application security analysis, cybersecurity compliance, or IT risk management within a software development or SaaS environment.
• Practical understanding of Security by Design (SbD) concepts, threat modelling principles, and application security baselines (e.g., OWASP, ISO 27001, NIST).
• Familiarity with modern software development lifecycles (SDLC), cloud hosting platforms (AWS, Azure, or GCP), and production service operations.
• Excellent stakeholder engagement skills with the ability to translate technical conversations with developers and engineers into structured security documentation.
• Methodical mindset with sharp attention to detail, capable of dissecting complex software ecosystems and systematically identifying governance gaps.
• Experience of MOD Secure by Design.
• Cyber assurance and risk management.
• Analysis of technical and security documentation.
• Stakeholder engagement and evidence gathering.
• Production of assurance artefacts and supporting documentation.

Nice to haves:

• Relevant industry certifications such as Security+, CISSP, CISA, CRISC, or cloud security badges (e.g., AWS Certified Security Specialty).

• Familiarity with Jira, Confluence, or automated GRC tools used for managing security backlogs and risk registers.

• Prior experience working in an Agile/Scrum software house setup.
  

Start date: Early November

Day rate: Up to £600 (depending on experience)

Initial contract length: 6 months (with possible extension)

Location: Portsmouth

Minimum security level: SC with no caveats

Nationality specification: Sole British Citizen (due to Client security requirement)

Number of days on site: Approximately 2-3 days per fortnightly sprint