Cyber Assurance Lead (Defence)

Defence Security Assurance Lead

Permanent  |  Belfast or London (Hybrid)  |  SC Held, DV Eligible

Morela is hiring a Defence Security Assurance Lead for a fast-growing UK sovereign AI scale-up. This is a permanent, full-time role, hybrid from either Belfast or London with travel to customer sites, reporting into the Security Lead. You will need active SC clearance and be eligible for DV. On offer is a competitive salary, pension, equity options and one of the most generous working patterns you will find anywhere.

About the Client

Our client builds a sovereign AI platform for organisations that can't compromise on security, including defence, national security, central government, policing and heavily regulated industries. They deliver real capability into some of the UK's most sensitive environments, so every feature is threat modelled, hardened and properly assured before it goes near customer data.

Security is central to the business and is now getting serious investment. The company is scaling a dedicated assurance function to match its growth in defence, and this hire is one of the founding roles in it.

The Role

You will own cyber assurance for the products and services delivered to the MOD and to allied defence and national security customers. Your job is to build the evidence-led assurance that customer risk owners depend on, applying Secure by Design for both UK and international partners.

You will work with engineering, product, IT, commercial and leadership, and directly with customers and assurance authorities. The scope is broad and will change as the business grows, so it suits someone curious and self-driven who wants a real hand in shaping a security function and a direct influence on new capability for defence.

Responsibilities

Lead Secure by Design for the product across defence deployments, in line with JSP 440 and JSP 453 Develop assurance cases using a claims, arguments and evidence approach, built to keep pace with rapid agile delivery Assure AI-enabled capability against JSP 936 and the wider MOD framework landscape Apply NIST CSF, RMF, AI RMF and SP 800-53 where they fit Act as the main point of contact for customer risk owners and cyber assurance authorities Help shape and deliver the overall security strategy, and play a key part in building out the security function as the business grows Champion good security practice across engineering teams

Essential Requirements

Security assurance experience within UK defence or national security, with hands-on application of Secure by Design Working knowledge of JSP 440 and JSP 453, plus awareness of DCPP and Def Stan 05-138 Experience turning technical evidence into robust assurance cases Threat modelling on live systems using STRIDE, attack trees or similar methods CISSP certification Active SC clearance and eligibility for DV

Desirable Experience

Experience assuring AI or machine learning systems, or knowledge of JSP 936 Understanding of AI attack types such as prompt injection, data poisoning and agent tool misuse, including MITRE ATLAS Familiarity with NCSC secure AI guidance and the UK AI Cyber Security Code of Practice Structured assurance notations such as CAE or GSN, ideally linked to machine-readable evidence Assurance work in air-gapped or classified environments Running, auditing or developing ISO management systems such as ISO 27001 or ISO 42001

Working Environment

Permanent, full-time, hybrid from Belfast or London, with travel to customer sites Competitive salary, company pension and equity options in a high-growth scale-up A working pattern that gives back around 30 extra days a year on top of annual leave, with full four-day weeks over the summer and December, regular paid Fridays off and early Friday finishes Cutting-edge AI tools used as everyday working kit A delivery-first culture that values impact over optics and people over politics, with real influence on how the business runs as it grows Interested? Get in touch with Adam Moore at with your CV and current availability