Bureau and BASS Consultant

Role overview This permanent assurance role assesses the controls and resilience of organizations and services involved in payment processing. You will lead or support complex reviews, advise stakeholders on technical risks, and help strengthen assurance practices across a broad network of participants and suppliers. The role is remote with regular office attendance and may require national travel, including overnight stays.

Responsibilities - Lead or support high-risk and escalated assessments, inspections, supplier reviews, incident follow-ups, and reviews of major changes or projects. - Evaluate control design and operation, evidence quality, residual risk, remediation plans, and assurance outcomes; track and escalate significant or overdue actions. - Maintain proportionate review frameworks and materials that address areas such as hosted services, concentration risk, aggregators, and emerging technology. - Prepare assurance reports, executive papers, progress updates, and management information for decisions and oversight. - Coach inspectors and colleagues, improve consistency and efficiency, and address recurring control weaknesses. - Represent the function in senior meetings and key supplier engagements when deputizing for the senior manager.

Requirements - Experience in payments, cyber assurance, IT audit, technology risk, security compliance, or supplier assurance. - Ability to lead audits or inspections, test controls, assess evidence and compensating measures, judge residual risk, and document clear findings and remediation. - Practical knowledge of public key infrastructure, certificate authorities, digital signatures, and certificate and cryptographic key lifecycles; familiarity with hardware security modules and privileged administration. - Ability to assess technical architectures and dependencies, including networks, data flows, APIs, identity services, cloud or hosted environments, and third parties. - Experience assessing security and resilience controls such as access management, vulnerability management, monitoring, incident response, secure development, continuity, and recovery. - Clear communication, sound judgement, strong analysis and organization, and the ability to manage competing deadlines; willingness to travel nationally, including overnight as needed.

Nice to have - Familiarity with supply chain, subcontractor, fourth-party, and concentration risk, and with the scope and limitations of ISO 27001, Cyber Essentials Plus, SOC 1/SOC 2, PCI DSS, or ISO 22301 assurance.

Benefits and work setup - Work from home, with at least 40% of working time in the office. - Permanent and fixed-term employees may be eligible for a non-contributory pension, discretionary annual bonus, 30 days of annual leave plus public holidays, and health and protection benefits. Some benefits depend on completing probation.