Associate Director

This role is within the Security Consultancy sub-team who provide specialist technical security advice collaborating with technical and business teams throughout the entire or part of a digital solution’s life cycle. The team owns and develops Security Patterns, Security Specifications, and the Threat Modelling Framework, to support secure technology innovation in a changing threat landscape. The purpose of this role is to advise on the technical security aspects of digital solutions to be evaluated or developed and implemented by technology teams across KPMG Group for internal use, or as a service or product to KPMG clients.

Essential Skills/Experience:
• Have worked in at least one of:
o Infrastructure/Solution Architect
o Technical Security Architect/Consultant
o Security Operations
o Secure application development
• A good understanding of concepts and their application across several key areas including application, cloud, and SaaS security, best practices, and industry standards (and where relevant, AI/GenAI security concepts).
• You will bring hands on experience and knowledge in securing digital products/solutions in at least one or more of the following areas:
o Artificial intelligence (e.g. AWS Bedrock, CoPilot, CoPilot Studio, Google Gemini, Azure OpenAI, Google Vertex)
o Cloud (e.g. AWS, Azure/M365, Google, ServiceNow, SAP)
o Networks (e.g. firewalls, routers, switches, WIFI, LAN/WAN, SDN)
o Operating Systems and hardware (e.g. Microsoft, Linux, Apple, Android)
o Security Solutions (e.g. Entra ID, CyberArk, SailPoint, Threat Modeler)
• Good experience of working in an Agile/DevOps software development environment using Threat Modelling.
• Be able to demonstrate the ability to adapt communication style to explain technical concepts to different people within an organisation whether advising stakeholders, directing teams, or sharing experience.
• Experience prioritising and delivering in an environment with competing demands and evolving requirements.
• Able to navigate through complex security problems to find the root cause and a balanced outcome, taking ownership of activities.
It would be desirable if you can demonstrate some, or all of the following:
• Container/serverless platforms.
• Infrastructure/network security.
• Modern application development processes and testing.
• AI/GenAI security (e.g. threat modelling for AI solutions, prompt injection and data exfiltration risks, data poisoning/model integrity risks, model/service supply chain considerations, and applying appropriate guardrails and monitoring).
• Have or working towards technical security certifications (e.g. CISSP, CCSP, Microsoft/Google/AWS technologies).
• Having worked in customer service/regulated environments, delivering high quality information security services.