Senior Associate – Cloud and Platform Assurance Specialist
Division: Operations
Department: Cyber & Information Resilience (C&IR)
- Salary: National (Edinburgh and Leeds) ranging from £53,000 to £69,000 and London from £59,000 to £75,000 (salary offered will be based on skills and experience)
- This role is graded as: Senior Associate - Regulatory
- Your external recruitment contact is Raimonda via [email protected]
- Your internal recruitment contact is Fizah via [email protected]
- Applications must be submitted through our online portal.
- Applications sent via social media or email will not be accepted.
About the FCA and team
We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth, and shaping the future of UK finance services.
We are recruiting a Senior Associate – Cloud and Platform Assurance Specialist to join the Platform Assurance team within Cyber & Information Resilience.
The role will provide independent security assurance across the FCA’s cloud-hosted and SaaS services, with a particular focus on public-cloud security, Cloud Security Posture Management, SaaS Security Posture Management and cloud control effectiveness.
This role is positioned at Senior Associate level and is suited to an experienced security professional with solid technical knowledge of at least one major public-cloud platform, ideally Microsoft Azure and the ability to apply assurance principles consistently across Azure, AWS, SaaS and other cloud-hosted services.
You will combine architectural understanding with an assurance-led mindset, independently reviewing control design and effectiveness, validating security findings and helping platform and engineering teams make proportionate, risk-based remediation decisions. The position will remain independent from the ownership and implementation of the controls it assesses.
Although cloud assurance will be the principal focus, the role may also support assurance across identity, network, endpoint, secure software development and wider platform controls where these intersect with cloud services.
Role responsibilities
- Acting as a cloud assurance SME, providing self-directed feedback and guidance on cloud architecture, control design, implementation and effectiveness, while reviewing cloud architectures, data flows, trust boundaries and control dependencies to identify material design weaknesses, systemic control gaps and unmanaged exposure
- Supporting and contributing to risk-based assurance reviews across public-cloud and SaaS services, with particular emphasis on Microsoft Azure, while applying consistent, cloud-agnostic assurance principles.
- Providing assurance over CSPM, CNAPP, SSPM and related exposure-management capabilities, including assessing coverage, configuration, findings, exceptions, risk prioritisation and remediation outcomes, and validating whether identified exposures represent genuine risk through root-cause analysis and assessment of underlying control effectiveness.
- Assessing cloud security controls, baselines, policies and guardrails across identity and privileged access, network security, workload protection, configuration management, data protection, logging and monitoring, vulnerability management and resilience, ensuring appropriate and consistent control coverage.
- Working collaboratively with cloud platform owners, engineering teams, security teams and service owners to agree pragmatic remediation, validate compensating controls and support proportionate risk-based decisions.
- Supporting assurance activities across broader cyber security domains, including identity, network, endpoint security and secure software delivery controls, where these underpin cloud services or cloud-hosted workloads
- Producing clear, evidence-based assurance conclusions, metrics, KPIs and KRIs for management and risk forums, covering control effectiveness, exposure, remediation and residual risk
- Contributing to the continuous improvement of cloud assurance methodologies, standards, testing approaches and tooling, aligned with relevant NCSC, NIST, CIS and CSA guidance
- Monitoring developments in cloud technologies, threat patterns and security practices, assessing their relevance to the FCA's cloud risk profile and assurance approach.
Skills required
Minimum:
- Strong technical security knowledge of at least one major public-cloud platform, ideally Microsoft Azure, with practical experience across identity and access management, privileged access, network security, workload and data protection, configuration governance, logging and monitoring, vulnerability management, and resilience.
- Demonstrable experience independently assessing cloud architectures and security controls, including evaluating control design, implementation, and operating effectiveness, while remaining independent from ownership or implementation of the controls being assessed.
- Experience leading or conducting end-to-end, risk-based cloud security assurance activities, including scoping, evidence gathering, control testing, reporting findings, making remediation recommendations, and validating that actions have been completed effectively.
- Practical experience using or assuring CSPM, CNAPP, SSPM or comparable cloud security posture and exposure-management capabilities, including validating findings, assessing coverage, identifying root causes, and distinguishing isolated issues from wider systemic control weaknesses.
- Strong communication and stakeholder-management skills, with the ability to translate technical issues into clear business and security risks, produce concise assurance conclusions and constructively challenge technical teams, control owners, and senior stakeholders
Essential:
- Experience evaluating cloud security baselines, policies, guardrails, exceptions, and compensating controls, including identifying gaps in configuration governance and control implementation.
- Strong knowledge of recognised security and assurance frameworks, with experience applying standards such as NCSC guidance, the NIST Cybersecurity Framework, CIS Benchmarks, and the CSA Cloud Controls Matrix.
- Experience applying cloud security and assurance principles across Azure, AWS, SaaS, hybrid or other cloud-hosted services, including identifying control inconsistencies, shared-responsibility gaps and duplicated or unclear ownership between environments.
- Experience assessing material cloud exposures, including attack paths, excessive permissions, toxic combinations, and risks introduced through cloud-native delivery, infrastructure as code, CI/CD pipelines, containers, or platform-engineering controls.
- Experience working in a regulated or similarly complex environment, with the ability to contribute to cloud-assurance methodologies and produce meaningful metrics, KPIs or KRIs covering control effectiveness, security exposure, assurance coverage, and remediation progress
Benefits
- 25 days annual leave plus bank holidays
- Non-contributory pension (8–12% depending on age) and life assurance at eight times your salary
- Private healthcare with Bupa, income protection, and 24/7 Employee Assistance
- 35 hours of paid volunteering annually
- Hybrid model where employees work a minimum of 40% in the office each month (expectation of 50% for senior leaders). Changing from September to a minimum of 50% in the office each month (expectation of 60% for Directors and Executive Directors)
- A flexible benefits scheme designed around your lifestyle
For a full list of our benefits, and our recruitment process as a whole visit our benefits page .
Our values and culture
Our colleagues are the key to our success as a regulator. We are committed to fostering a diverse and inclusive culture: one that’s free from discrimination and bias, celebrates difference, and supports colleagues to deliver at their best. We believe that our differences and similarities enable us to be a better organisation – one that makes better decisions, drives innovation, and delivers better regulation.
If you require any adjustments due to a disability or condition, your recruiter is here to help - reach out for tailored support.
We welcome diverse working styles and aim to find flexible solutions that suit both the role and individual needs, including options like part-time and job sharing where applicable.
Disability confident: our hiring approach
We’re proud to be a Disability Confident Employer , and therefore, people or individuals with disabilities and long-term conditions who best meet the minimum criteria for a role will go through to the next stage of the recruitment process. In cases of high application volumes we may progress applicants whose experience most closely matches the role’s key requirements.
Useful information and timelines
Timeline:
- Job advert closes: Midnight, 23rd August 2026
- CV Review/Shortlist: 25th August 2026
- Interview: w/c 31 August 2026
- Your Recruiter will discuss the process in detail with you during screening for the role, therefore, please make them aware if you are going to be unavailable for any date during this time.
SC Clearance is required for this role ( SC Guidance ) - you will hold or will be required to obtain Security Check (SC) level vetting
