Senior Cloud Security Consultant

We’re hiring!

Aon is seeking a Senior Cloud Security Consultant to join our Digital M&A Advisory practice in London.

The team advises private equity investors, infrastructure funds and corporate clients on technology, IT, cyber and digital risks across acquisitions, portfolio companies and strategic transformation initiatives. Our work spans cyber due diligence, technical cyber reviews, cyber risk assessments, cloud and infrastructure security reviews, separation and integration support, and post-transaction cyber value creation.

This role is ideally suited to a technically strong cloud security specialist with hands-on experience designing, configuring, securing or assessing Microsoft Azure and Amazon Web Services (AWS) environments. Previous M&A experience is not required.

You will act as the technical cloud security lead on our engagements, working directly with investors, CISOs, cloud and engineering teams and C-suite executives to assess cloud security posture, identify exposures and translate technical findings into clear business and investment implications.

This is a fast-paced, client-facing role offering significant exposure to a broad range of industries, cloud environments and technologies.

About Aon

Headquartered in London, Aon Plc is a leading global professional services firm providing a broad range of risk, retirement and health solutions. Our 50,000 colleagues in 120 countries empower results for clients by using proprietary data and analytics to deliver insights that reduce volatility and improve performance.

Aon is an equal opportunities employer. Aon's recruitment and selection policy ensures the best possible skill mix of colleagues and the highest quality candidates are appointed using objective job-related criteria.

About the Role

Your impact as a Senior Cloud Security Consultant

• You will be responsible for leading the cloud security elements of engagements across private equity and corporate clients, including:
• Leading technical cloud security reviews of Azure and AWS environments as part of cyber due diligence, technical review and portfolio company engagements.
• Assessing cloud tenancy and account architecture, including Azure management groups, subscriptions and landing zones, and AWS Organizations, accounts, OUs and Control Tower set-up.
• Reviewing identity and access management across cloud and hybrid environments, including Microsoft Entra ID, AWS IAM and IAM Identity Center, privileged access, role-based access control, conditional access, MFA, service principals and workload identities.
• Evaluating cloud network architecture and segmentation, including VNets/VPCs, security groups, firewalls, private endpoints, internet exposure and hybrid connectivity.
• Assessing cloud security configuration and posture using native and third-party tooling (e.g. Microsoft Defender for Cloud, AWS Security Hub, GuardDuty, CSPM/CNAPP platforms) against CIS Benchmarks and Well-Architected security guidance.
• Reviewing data protection controls, including encryption, key management (Azure Key Vault, AWS KMS), secrets management, storage exposure and backup resilience.
• Assessing logging, monitoring and detection capabilities, including Azure Monitor, Microsoft Sentinel, AWS CloudTrail, CloudWatch and integration with SOC/SIEM services.
• Reviewing infrastructure-as-code, DevSecOps practices and CI/CD pipeline security where relevant.
• Translating technical findings into prioritised, commercially relevant risks, remediation roadmaps and cost estimates for investors and management teams.
• Producing high-quality reports, presentations and executive briefings.
• Managing technical workstreams and supporting engagement delivery across multiple concurrent projects.
• Working closely with colleagues across technology, cyber, M&A and risk advisory disciplines.
• Contributing to the development of the team's technical review methodologies, cloud assessment tooling and market offerings.
• Supporting client engagements across the UK and EMEA.

About you

Your knowledge and expertise

Technical

• Demonstrable experience in cloud security engineering, cloud architecture, security consulting or a related technical role.
• Strong, hands-on knowledge of Microsoft Azure and AWS, including technical set-up, tenancy/account structure and security architecture.
• Experience crafting, implementing or assessing one or more of the following:
• Identity and access management (Entra ID, AWS IAM, PIM/PAM, conditional access, federation and SSO)
• Landing zones, management groups, AWS Organizations and guardrails (Azure Policy, SCPs)
• Cloud network security and hybrid connectivity
• Cloud security posture management and workload protection (CSPM/CWPP/CNAPP)
• Logging, monitoring and threat detection (Sentinel, Defender, GuardDuty, CloudTrail)
• Encryption, key and secrets management
• Container and Kubernetes security (AKS, EKS)
• Infrastructure-as-code (Terraform, Bicep/ARM, CloudFormation) and DevSecOps
• Cloud backup, resilience and disaster recovery
• Familiarity with one or more of the following frameworks and guidelines:
• CIS Benchmarks for Azure and AWS

Microsoft Cloud Security Benchmark

AWS and Azure Well-Architected Frameworks (Security Pillar)

Cloud Adoption Frameworks

NIST CSF

ISO 27001 / 27017

CSA Cloud Controls Matrix

• Understanding of attack paths and common cloud attack techniques (e.g. privilege escalation, misconfiguration exploitation, credential compromise), and how they impact critical business assets.
• Ability to read and interpret cloud configuration exports, scripts and tooling outputs (e.g. PowerShell, Azure CLI, AWS CLI, KQL).
• Experience identifying and assessing cloud and cyber risks within complex environments, with the ability to communicate technical findings and business implications to both technical and non-technical stakeholders.
• Strong analytical and problem-solving skills.
• Commercial awareness and the ability to understand business implications of technology and security decisions.
• Excellent written and verbal communication skills with the ability to convey complex technical concepts to non-technical audiences.

Team & Client Management

• Experience managing technical workstreams and contributing to successful project delivery.
• Strong stakeholder management and presentation skills.
• Ability to engage effectively with both technical teams and senior business executives.
• Experience developing positive client relationships.
• Comfortable working within multidisciplinary and global teams and fast-paced consulting environments.
• Ability to manage multiple engagements and competing priorities.
• Highly organised with strong attention to detail and quality.

Highly Desirable

• Experience with Google Cloud Platform or multi-cloud environments.
• Exposure to attack path analysis, exposure management or cyber risk quantification platforms.
• Experience of cloud penetration testing, red teaming or security assurance reviews.
• Experience supporting cloud migrations, tenant-to-tenant migrations or separation/integration programmes.

Industry-recognised certifications, such as

Microsoft Certified: Azure Security Engineer Associate (AZ-500)

Microsoft Certified: Cybersecurity Architect Expert (SC-100)

AWS Certified Security – Specialty

AWS Certified Solutions Architect

CCSP

CISSP

CCSK

• Experience working with private equity-backed businesses or large corporate organisations.
• Experience mentoring junior team members or supporting team development initiatives.
• Interest in business development and market-facing activities. Experience or interest in line management.
• Interest in supporting client relationship management.

What Success Looks Like

• Delivering high-quality, technically robust cloud security reviews for private equity and corporate clients.
• Acting as the go-to cloud security expert across engagements.
• Building trusted relationships with client technology, security and business stakeholders.
• Providing insightful, commercially relevant recommendations that support investment and operational decision-making.
• Contributing to the growth and development of the Digital M&A Advisory practice and its technical capabilities.
• Supporting the development of junior colleagues and improving team capabilities.

#li-nw1

2577522