Cyber Security Consultant

Location: Ebbw Vale, United Kingdom

Thales people architect identity management and data protection solutions at the heart of digital security. Business and governments rely on us to bring trust to the billons of digital interactions they have with people. Our technologies and services help banks exchange funds, people cross borders, energy become smarter and much more. More than 30,000 organizations already rely on us to verify the identities of people and things, grant access to digital services, analyze vast quantities of information and encrypt data to make the connected world more secure.

Together we offer fantastic opportunities for committed employees to learn and develop their career with us. At Thales UK, we research, develop, and supply technology and services that impact the lives of millions of people each day to make life better, and keep us safer. We innovate across five major industries; Aerospace, Defence, Ground Transportation, Security and Space. Your health and well-being matters to us and that’s why we offer you the flexibility to do what’s important to you; whether that’s part time hours, job sharing, home working, or the ability to flex your start and finish times. Where possible, we support a working pattern that suits your lifestyle and helps you reach your ambitions.

**Title: Cyber Security Consultant - Industrial**

**Our opportunity**

To provide business driven, cost effective advice on the design for Industrial Control Systems (ICS) customers that follows international standards and guidance:

- Advise clients on regulation and standards that are applicable to the sector of operation
- Provide guidance on how a client can turn their enterprise requirements into secure ICS designs
- Undertake asset discovery activities to identify an ICS estate
- Identify the vulnerabilities in the ICS environment and provide advice on mitigations
- Support the design of secure operational environments
- Support clients in the development of policies and procedures to contribute to the resiliency of organisations and their ICS environments
- Support early client engagement to develop business opportunities
- Act as a trusted advisor to clients undertaking change activities

**Key Responsibilities and Tasks**
- Undertakes Asset discovery activities
- Production of ICS network diagrams
- Develop security evidence as required and specified by the customer to enable the effective investment decisions
- Check or report compliance with applicable security standards and procedures
- Selects or creates an appropriate methodology for use across the client programme.
- Identifies ICS risks which are systemic across the programme or business
- Understands and provides guidance on the threat environment
- Recommends implementation of new ICS security controls across the programme or enterprise to provide more cost effective risk mitigation in the long term and ensures these are traceable
- Plans and manages delivery of an ICS work programme

**Skills and Expertise**
- A degree or equivalent in related control systems or cyber security
- Good to have GIAC GICSP or ISC2 CISSP certification
- 5 years’ experience in an Industrial Control /Operational Technology environment (like: Automated manufacturing facility, Utility provider and Critical National Infrastructure
- Understanding of industrial control systems device configuration and possesses the ability to test, diagnose, configure and maintain control systems
- Articulate how security in the connected world is best implemented at the point where IT meets other industry domains such as manufacturing/CNI
- An understanding of the threats arising from the exploitation of vulnerabilities in the attack surfaces created across a distributed system and how these can be managed
- Understanding of how to secure a network using technologies and security protocols
- Undertake vulnerability assessments of networks and devices using tools and databases to produce a contextualised list of vulnerabilities
- Produce security architecture design documents that have been created through an analysis of the potential risks, which has taken into account threats and likely attack routes to a system and produces pragmatic security controls
- Selection of appropriate security components to provide security-enforcing functions that can be justified through the evaluation of component's security function and implementation
- Demonstrate a working knowledge of the Policies and Standards that are required for systems operating in a controlled environment. Such as ISO, industry specific for Nuclear / CNI / transportation or government/department policies
- Production of security risks through identification of vulnerabilities, assessment of exposure, likelihood and severity of the risk in a quantitative or qualitative format that follows an industry recognised risk assessment methodology
- Ability to analyse information and produce reports, network diagrams and recommendatio