Advise small and medium-sized organisations on implementing Cyber Essentials controls, including device scope, cloud services, access, firewalls, secure configuration, malware protection, and updates. Translate technical findings into practical actions, support remediation evidence, lead discovery calls and workshops, document recommendations, and coordinate with assessors while maintaining confidentiality and assessment independence. The associate contractor will complete IASME onboarding and attend occasional client sites across the UK.

Perform identity and access reviews across Microsoft 365, SharePoint, Teams, Entra ID, and a cloud data platform. Identify and remediate excessive permissions, guest accounts, unused groups, and open sharing. Develop PowerShell and Microsoft Graph automation, query permissions with SQL, and prepare audit evidence packs. Collaborate with client system owners to implement changes safely for a regulated financial services client.

Provides a focused security architecture review for a major UK enterprise technology integration programme. Defines requirements for APIs, messaging, file transfer, identities, access controls, encryption, secrets, network boundaries, monitoring, auditing, and go-live controls. Conducts threat modeling, ranks risks, supports platform and supplier selection, and communicates recommendations to technical and nontechnical stakeholders. The contract requires approximately five days of work across an eight- to ten-week period, primarily remotely with limited travel.