Senior Associate – Cloud and Platform Assurance Specialist

About this role

Senior Associate – Cloud and Platform Assurance Specialist

Division: Operations

Department:**Cyber & Information Resilience (C&IR)

• *Salary:*National (Edinburgh and Leeds) ranging from £53,000 to £69,000 and London from £59,000 to £75,000 (salary offered will be based on skills and experience)
• *This role is graded as:*Senior Associate - Regulatory
• *Your external recruitment contact is*Raimonda via raimonda.stankute@fca.org.uk
• *Your internal recruitment contact is*Fizah via fizahfarouk.ibrahim@fca.org.uk
• Applications must be submitted through our online portal.
• Applications sent via social media or email will not be accepted.

About the FCA and team

We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth, and shaping the future of UK finance services.

We are recruiting a Senior Associate – Cloud and Platform Assurance Specialist to join the Platform Assurance team within Cyber & Information Resilience.

The role will provide independent security assurance across the FCA’s cloud-hosted and SaaS services, with a particular focus on public-cloud security, Cloud Security Posture Management, SaaS Security Posture Management and cloud control effectiveness.

This role is positioned at Senior Associate level and is suited to an experienced security professional with solid technical knowledge of at least one major public-cloud platform, ideally Microsoft Azure and the ability to apply assurance principles consistently across Azure, AWS, SaaS and other cloud-hosted services.

You will combine architectural understanding with an assurance-led mindset, independently reviewing control design and effectiveness, validating security findings and helping platform and engineering teams make proportionate, risk-based remediation decisions. The position will remain independent from the ownership and implementation of the controls it assesses.

Although cloud assurance will be the principal focus, the role may also support assurance across identity, network, endpoint, secure software development and wider platform controls where these intersect with cloud services.

Role responsibilities

• Acting as a cloud assurance SME, providing self-directed feedback and guidance on cloud architecture, control design, implementation and effectiveness, while reviewing cloud architectures, data flows, trust boundaries and control dependencies to identify material design weaknesses, systemic control gaps and unmanaged exposure
• Supporting and contributing to risk-based assurance reviews across public-cloud and SaaS services, with particular emphasis on Microsoft Azure, while applying consistent, cloud-agnostic assurance principles.
• Providing assurance over CSPM, CNAPP, SSPM and related exposure-management capabilities, including assessing coverage, configuration, findings, exceptions, risk prioritisation and remediation outcomes, and validating whether identified exposures represent genuine risk through root-cause analysis and assessment of underlying control effectiveness.
• Assessing cloud security controls, baselines, policies and guardrails across identity and privileged access, network security, workload protection, configuration management, data protection, logging and monitoring, vulnerability management and resilience, ensuring appropriate and consistent control coverage.
• Working collaboratively with cloud platform owners, engineering teams, security teams and service owners to agree pragmatic remediation, validate compensating controls and support proportionate risk-based decisions.
• Supporting assurance activities across broader cyber security domains, including identity, network, endpoint security and secure software delivery controls, where these underpin cloud services or cloud-hosted workloads
• Producing clear, evidence-based assurance conclusions, metrics, KPIs and KRIs for management and risk forums, covering control effectiveness, exposure, remediation and residual risk
• Contributing to the continuous improvement of cloud assurance methodologies, standards, testing approaches and tooling, aligned with relevant NCSC, NIST, CIS and CSA guidance
• Monitoring developments in cloud technologies, threat patterns and security practices, assessing their relevance to the FCA's cloud risk profile and assurance approach.

Skills required

Minimum

• Strong technical security knowledge of at least one major public-cloud platform, ideally Microsoft Azure, with practical experience across identity and access management, privileged access, network security, workload and data protection, configuration governance, logging and monitoring, vulnerability management, and resilience.
• Demonstrable experience independently assessing cloud architectures and security controls, including evaluating control design, implementation, and operating effectiveness, while remaining independent from ownership or implementation of the controls being assessed.
• Experience leading or conducting end-to-end, risk-based cloud security assurance activities, including scoping, evidence gathering, control testing, reporting findings, making remediation recommendations, and validating that actions have been completed effectively.
• Practical experience using or assuring CSPM, CNAPP, SSPM or comparable cloud security posture and exposure-management capabilities, including validating findings, assessing coverage, identifying root causes, and distinguishing isolated issues from wider systemic control weaknesses.
• Strong communication and stakeholder-management skills, with the ability to translate technical issues into clear business and security risks, produce concise assurance conclusions and constructively challenge technical teams, control owners, and senior stakeholders

Essential

• Experience evaluating cloud security baselines, policies, guardrails, exceptions, and compensating controls, including identifying gaps in configuration governance and control implementation.
• Strong knowledge of recognised security and assurance frameworks, with experience applying standards such as NCSC guidance, the NIST Cybersecurity Framework, CIS Benchmarks, and the CSA Cloud Controls Matrix.
• Experience applying cloud security and assurance principles across Azure, AWS, SaaS, hybrid or other cloud-hosted services, including identifying control inconsistencies, shared-responsibility gaps and duplicated or unclear ownership between environments.
• Experience assessing material cloud exposures, including attack paths, excessive permissions, toxic combinations, and risks introduced through cloud-native delivery, infrastructure as code, CI/CD pipelines, containers, or platform-engineering controls.
• Experience working in a regulated or similarly complex environment, with the ability to contribute to cloud-assurance methodologies and produce meaningful metrics, KPIs or KRIs covering control effectiveness, security exposure, assurance coverage, and remediation progress

Benefits

• 25 days annual leave plus bank holidays
• Non-contributory pension (8–12% depending on age) and life assurance at eight times your salary
• Private healthcare with Bupa, income protection, and 24/7 Employee Assistance
• 35 hours of paid volunteering annually
• Hybrid model where employees work a minimum of 40% in the office each month (expectation of 50% for senior leaders). Changing from September to a minimum of 50% in the office each month (expectation of 60% for Directors and Executive Directors)
• A flexible benefits scheme designed around your lifestyle

For a full list of our benefits, and our recruitment process as a whole visit our benefits page .

Our values and culture

Our colleagues are the key to our success as a regulator.

About cyber security & digital forensics roles for ex-police

Cyber security, digital forensics and incident-response roles. DMIs, cybercrime investigators and digital forensics officers bring evidential discipline and investigative judgement that DFIR and security teams struggle to hire.