Cloud and Platform Assurance Specialist, Financial Conduct Authority
Senior Associate
£59-75k
AWS
Azure
Senior and Expert level
London
Financial regulation service
Job no longer available
Financial regulation service
1001+ employees
FintechB2BBankingAccounting
Job no longer available
£59-75k
AWS
Azure
Senior and Expert level
London
1001+ employees
FintechB2BBankingAccounting
Company mission
To enable a fair and thriving financial services market for the good of consumers and the economy.
Role
Who you are
- This role is positioned at Senior Associate level and is suited to an experienced security professional with solid technical knowledge of at least one major public-cloud platform, ideally Microsoft Azure and the ability to apply assurance principles consistently across Azure, AWS, SaaS and other cloud-hosted services
- Strong technical security knowledge of at least one major public-cloud platform, ideally Microsoft Azure, with practical experience across identity and access management, privileged access, network security, workload and data protection, configuration governance, logging and monitoring, vulnerability management, and resilience
- Demonstrable experience independently assessing cloud architectures and security controls, including evaluating control design, implementation, and operating effectiveness, while remaining independent from ownership or implementation of the controls being assessed
- Experience leading or conducting end-to-end, risk-based cloud security assurance activities, including scoping, evidence gathering, control testing, reporting findings, making remediation recommendations, and validating that actions have been completed effectively
- Practical experience using or assuring CSPM, CNAPP, SSPM or comparable cloud security posture and exposure-management capabilities, including validating findings, assessing coverage, identifying root causes, and distinguishing isolated issues from wider systemic control weaknesses
- Strong communication and stakeholder-management skills, with the ability to translate technical issues into clear business and security risks, produce concise assurance conclusions and constructively challenge technical teams, control owners, and senior stakeholders
- Experience evaluating cloud security baselines, policies, guardrails, exceptions, and compensating controls, including identifying gaps in configuration governance and control implementation
- Strong knowledge of recognised security and assurance frameworks, with experience applying standards such as NCSC guidance, the NIST Cybersecurity Framework, CIS Benchmarks, and the CSA Cloud Controls Matrix
- Experience applying cloud security and assurance principles across Azure, AWS, SaaS, hybrid or other cloud-hosted services, including identifying control inconsistencies, shared-responsibility gaps and duplicated or unclear ownership between environments
- Experience assessing material cloud exposures, including attack paths, excessive permissions, toxic combinations, and risks introduced through cloud-native delivery, infrastructure as code, CI/CD pipelines, containers, or platform-engineering controls
- Experience working in a regulated or similarly complex environment, with the ability to contribute to cloud-assurance methodologies and produce meaningful metrics, KPIs or KRIs covering control effectiveness, security exposure, assurance coverage, and remediation progress
- SC Clearance is required for this role - you will hold or will be required to obtain Security Check (SC) level vetting
What the job involves
- We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you’ll play a key part in protecting consumers, driving economic growth, and shaping the future of UK finance services
- We are recruiting a Senior Associate – Cloud and Platform Assurance Specialist to join the Platform Assurance team within Cyber & Information Resilience
- The role will provide independent security assurance across the FCA’s cloud-hosted and SaaS services, with a particular focus on public-cloud security, Cloud Security Posture Management, SaaS Security Posture Management and cloud control effectiveness
- You will combine architectural understanding with an assurance-led mindset, independently reviewing control design and effectiveness, validating security findings and helping platform and engineering teams make proportionate, risk-based remediation decisions
- The position will remain independent from the ownership and implementation of the controls it assesses
- Although cloud assurance will be the principal focus, the role may also support assurance across identity, network, endpoint, secure software development and wider platform controls where these intersect with cloud services
- Acting as a cloud assurance SME, providing self-directed feedback and guidance on cloud architecture, control design, implementation and effectiveness, while reviewing cloud architectures, data flows, trust boundaries and control dependencies to identify material design weaknesses, systemic control gaps and unmanaged exposure
- Supporting and contributing to risk-based assurance reviews across public-cloud and SaaS services, with particular emphasis on Microsoft Azure, while applying consistent, cloud-agnostic assurance principles
- Providing assurance over CSPM, CNAPP, SSPM and related exposure-management capabilities, including assessing coverage, configuration, findings, exceptions, risk prioritisation and remediation outcomes, and validating whether identified exposures represent genuine risk through root-cause analysis and assessment of underlying control effectiveness
- Assessing cloud security controls, baselines, policies and guardrails across identity and privileged access, network security, workload protection, configuration management, data protection, logging and monitoring, vulnerability management and resilience, ensuring appropriate and consistent control coverage
- Working collaboratively with cloud platform owners, engineering teams, security teams and service owners to agree pragmatic remediation, validate compensating controls and support proportionate risk-based decisions
- Supporting assurance activities across broader cyber security domains, including identity, network, endpoint security and secure software delivery controls, where these underpin cloud services or cloud-hosted workloads
- Producing clear, evidence-based assurance conclusions, metrics, KPIs and KRIs for management and risk forums, covering control effectiveness, exposure, remediation and residual risk
- Contributing to the continuous improvement of cloud assurance methodologies, standards, testing approaches and tooling, aligned with relevant NCSC, NIST, CIS and CSA guidance
- Monitoring developments in cloud technologies, threat patterns and security practices, assessing their relevance to the FCA's cloud risk profile and assurance approach
Application process
- Job advert closes: Midnight, 23rd August 2026
- CV Review/Shortlist: 25th August 2026
- Interview: w/c 31 August 2026
- Your Recruiter will discuss the process in detail with you during screening for the role, therefore, please make them aware if you are going to be unavailable for any date during this time
Salary benchmarks
Our take
Developed on the back of the Financial Services Act of 2012, the Financial Conduct Authority is a regulatory body that acts as a regulator for financial firms, ensuring the integrity of the financial markets in the UK. Broadly focused on financial companies that provide consumer services, it’s governed by the Bank of England and therefore acts independently of the government.
The FCA is responsible for regulatory innovations, such as stronger customer authentication requirements, including biometric and code requirements for payments, that have clamped down on fraud and improved security for national consumers. The FCA also introduced the Anti-Money Laundering Supervision in 2017.
The organisation’s independence from government ensures its impartiality as a regulator. In the late 2010s, it set up the cryptoasset registration, a department responsible for ensuring the legality of crypto payments. This has become an important aspect of national counter terrorism measures, and exemplifies the complex and vital work that the organisation carries out.
Steph
Company Specialist at Welcome to the Jungle
Insights
Company
Company benefits
- 25 days holiday per year plus bank holidays
- Hybrid working (work from home up to 60% of your time)
- Private healthcare with Bupa
- A non-contributory Pension of at least 8%
- Life assurance
- Income protection
Company HQ
Stratford Cross, London, UK
Leadership
Nikhil Rathi
(CEO)Previously the Private Secretary to UK Prime Ministers Tony Blair and Gordon Brown and was the Chief of Staff and Director of International Development at the London Stock Exchange. Studied at St Anne's College Oxford.
Share this job
View 2 more jobs at Financial Conduct Authority