Information Security Review & Threat Modelling Engineer

Responsibilities

• Perform end-to-end security reviews of infrastructure products to ensure compliance with enterprise information security standards.
• Conduct threat modelling using methodologies such as STRIDE, PASTA, or MITRE ATT&CK/ATLAS.
• Identify security vulnerabilities, compliance gaps, and non-conformities within technical architectures.
• Produce detailed security findings and recommend effective remediation or risk mitigation strategies.
• Work closely with engineering teams and third-party vendors to validate secure technical architectures.
• Support internal and external security audits by maintaining high-quality technical documentation and audit-ready evidence.
• Embed quality control measures across security review processes and manage stakeholder expectations.

Requirements

• Minimum 6 years of IT experience, including at least 4 years specifically in Cyber Security/Information Security.
• Hands-on cloud security expertise across AWS and/or GCP environments.
• Demonstrated expertise in Threat Modelling methodologies (STRIDE, PASTA, or MITRE).
• Strong understanding of Infrastructure as Code (Terraform and/or CloudFormation).
• Proficiency in Python scripting with the ability to read, write, and analyse scripts.
• Deep understanding of authentication, authorisation, encryption, logging, monitoring, and network segmentation.
• Experience working within the Software Development Lifecycle (SDLC) and CI/CD pipelines.
• Mandatory Associate or Professional AWS or GCP Cloud Certification.
• Mandatory Associate or Professional Cyber Security Certification.

Preferred Qualifications

• Degree in Computer Science, Cyber Security, or a related discipline.
• Practical experience in security testing.

About the Company

Deloitte is a leading global provider of professional services, supporting major financial institutions through large-scale technology transformations and high-performance cyber security initiatives.