Security Risk Specialist - 6-Month Contract - Inside IR35 - Hybrid London (2-3 Days Onsite)
A leading technology-driven organisation is seeking an experienced Security Risk Specialist to support the ongoing development and operation of its security risk function. This role sits within a growing security team and will focus on strengthening how the business identifies, evaluates, and manages security-related risks across a modern, cloud-centric environment.
Working closely with the Head of Security Risk & Assurance, you will play an integral part in shaping risk methodology, enhancing processes, and advising stakeholders across engineering, product, operations, and wider business units. This is a hands-on contract suitable for someone who enjoys driving practical improvements and embedding risk management into day-to-day operations.
Key Responsibilities You will:
*Contribute to the operation, enhancement, and governance of the security risk management framework, ensuring alignment with business goals, regulatory needs, and recognised industry practices.
*Conduct detailed security risk assessments and support the creation of appropriate risk responses, mitigation plans, and treatment recommendations.
*Review, refine, and optimise existing risk processes-highlighting inefficiencies, identifying gaps, and advising on improvements, including automation and tooling opportunities.
*Collaborate with engineering, technology, and non-technical teams to embed risk-aware thinking into projects, initiatives, and operational decision-making.
*Develop and improve risk dashboards, reporting packs, and metrics to increase visibility and support stakeholder decision processes.
*Contribute to the creation and evolution of security awareness materials and internal training related to risk management.
Required Experience You will have:
*Hands-on experience in security risk management within a dynamic, high-growth, or highly regulated environment.
*A background designing, maintaining, or enhancing governance processes and procedures, ideally related to security or technology risk.
*Strong experience performing risk assessments across cloud environments and modern technology stacks.
*Good understanding of how agile, product-led, and engineering-focused organisations operate.
*Experience producing and interpreting security metrics, plus building reporting that supports risk-based decision-making.
*Confidence engaging stakeholders of varying technical levels, from engineers to senior non-technical leaders.
*Familiarity with frameworks and standards such as ISO 27001, NIST CSF, NIST 800-53, SOC 2, PCI DSS, etc.
*Practical experience applying Large Language Models (LLMs) in security workflows, including: *Speeding up risk analysis and documentation
*Supporting control assessments and evidence evaluation
*Drafting and refining policies, standards, and procedures
*Improving reporting, insights, and communication

*Ability to identify where automation, AI, or LLM-based tooling can improve consistency and operational efficiency.
Nice to Have *A blend of consultancy and in-house experience within security, assurance, or risk management.
*Exposure to enterprise GRC / integrated risk management platforms.
*Relevant certifications such as CISM, CRISC, CISSP, CISA, or similar.