Change Assurance Lead - Contract

Change Assurance Consultant - Contract

Remote / Hybrid - £550-650 per day - Outside IR35 – 9-12 month initial contract, with likely extension

The engagement

One of our engagements needs an experienced independent consultant to work alongside our team to lead security change assurance across its technology change portfolio. You’ll provide objective, expert assurance that security is properly designed in and delivered across the programme, from early design through to go-live and handover into service.

You’ll be the independent voice in change governance: assessing risk, setting proportionate security requirements, and giving clear, evidence-based recommendations on whether change is ready to proceed. Alongside this, you’ll track and report the organisation’s improving security maturity, so leadership can see the cumulative impact of better-assured change over time.

Scope of work

• Lead security change assurance: run the security review gate for medium and high risk technology change, assessing designs, architectures, suppliers and implementation plans at key delivery stages.

• Provide go-live assurance: give clear, defensible go/no-go recommendations, ensuring residual risks are understood, owned and formally accepted before change goes live.

• Embed security in change governance: integrate security assurance into [design authority / architecture review board / CAB / project lifecycle] processes so security is considered early and consistently, not as a last-minute check.

• Track risks and remediation through delivery: follow assurance findings and conditions through to closure, and ensure they carry into service once projects transition to business as usual.

• Own maturity benchmarking: baseline and periodically reassess security maturity against [framework(s), e.g. NCSC CAF, NIST CSF, ISO/IEC 27001], reporting trends and improvement to leadership.

• Coordinate the assessment cycle: bring together assessment activity [e.g. control testing, third-party assessments, audit and pen test findings] into a single, tracked view of improvement.

• Standardise assurance practice: establish consistent, proportionate change assurance methods, criteria and templates across the cyber security function that remain in place after the engagement.

Key deliverables

• An operating, risk-based security change assurance gate for in-scope projects

• A documented change assurance framework, including assessment criteria, templates and risk acceptance process

• Assurance reports and go-live recommendations for in-scope change

• Regular reporting on change assurance outcomes and maturity trends

What you’ll bring

• A strong track record delivering security change assurance or project security assurance, ideally within government or very large corporate environments
• Experience working within project and programme delivery governance (stage gates, design authorities, architecture review, change boards)
• The credibility and independence to challenge delivery teams and senior stakeholders constructively, including recommending against go-live when warranted
• Strong written reporting and stakeholder communication skills
• Desirable: [e.g. CISSP, CISM, CISA, NCSC Certified Cyber Professional (CCP)]