Senior Cyber Security Consultant

We’re hiring!

Aon is seeking a Senior Cyber Security Consultant to join our Digital M&A Advisory practice in London.

The team advises private equity investors, infrastructure funds and corporate clients on technology, IT, cyber and digital risks across acquisitions, portfolio companies and strategic transformation initiatives. Our work spans cyber due diligence, technical cyber reviews, cyber risk assessments, separation and integration support, and post-transaction cyber value creation.

This role is ideally suited to a technically strong security professional with a background in red teaming, penetration testing or offensive security who wants to apply an attacker’s mindset in an advisory setting. This is not a red teaming role: rather than carrying out offensive operations, you will use your understanding of how real-world attackers think and operate to assess client environments, identify the exposures that matter most, and explain cyber risk in terms investors and executives can act on. Previous M&A experience is not required.

You will bring an adversarial perspective to our engagements, working directly with investors, CISOs, technology teams and C-suite executives to resolve how an organisation could realistically be compromised, what the business impact would be, and what should be prioritised to reduce risk.

This is a fast-paced, client-facing role offering significant exposure to a broad range of industries, environments and technologies, and a clear path for offensive security professionals looking to move into strategic, consultative work.

About Aon

Headquartered in London, Aon Plc is a leading global professional services firm providing a broad range of risk, retirement and health solutions. Our 50,000 colleagues in 120 countries empower results for clients by using proprietary data and analytics to deliver insights that reduce volatility and improve performance.

Aon is an equal opportunities employer. Aon's recruitment and selection policy ensures the best possible skill mix of colleagues and the highest quality candidates are appointed using objective job-related criteria.

About the Role

Your impact as a Senior Cyber Security Consultant

• You will be responsible for bringing an attacker-informed perspective to engagements across private equity and corporate clients, including:
• Leading technical cyber security reviews as part of cyber due diligence, technical review and portfolio company engagements.
• Assessing client environments from an adversary’s perspective, identifying realistic attack paths across identity, network, cloud, endpoint and application layers to critical business assets.
• Reviewing external attack surface and internet-facing exposure, using passive and non-intrusive reconnaissance techniques and threat intelligence.
• Evaluating the effectiveness of security controls (e.g. EDR, MFA, segmentation, privileged access, logging and detection) against known attacker tactics, techniques and procedures, mapped to MITRE ATT&CK.
• Interpreting and challenging the results of client penetration tests, red team exercises and vulnerability assessments, assessing scope, quality, remediation status and residual risk.
• Assessing detection and response maturity, including SOC capability, alerting coverage and incident response readiness against realistic threat scenarios.
• Developing threat-led risk scenarios (e.g. ransomware, data exfiltration, supply chain compromise) tailored to a client’s sector and business model.
• Advising on the scoping and procurement of offensive security testing for portfolio companies, and helping clients get value from those exercises.
• Translating technical findings into prioritised, commercially relevant risks, remediation roadmaps and cost estimates for investors and management teams.
• Producing high-quality reports, presentations and executive briefings.
• Managing technical workstreams and supporting engagement delivery across multiple concurrent projects.
• Working closely with colleagues across technology, cyber, M&A and risk advisory disciplines, and acting as a technical sounding board for the wider team.
• Contributing to the development of the team's technical review methodologies, threat-led assessment approaches and market offerings.
• Supporting client engagements across the UK and EMEA.

About you

Your knowledge and expertise

Technical

• Demonstrable experience in red teaming, penetration testing, adversary simulation or offensive security, gained in a consultancy, in-house or government setting.
• A strong, practical understanding of how attackers gain initial access, escalate privileges, move laterally and achieve their objectives in enterprise environments.
• A genuine interest in moving from hands-on testing into advisory, risk-focused and client-facing work.

Offensive experience across one or more of the following

• Active Directory and Entra ID attack techniques
• Infrastructure and internal network testing
• Cloud security testing (Azure, AWS and/or Google Cloud)
• External attack surface and perimeter testing

Web application and API security

• Social engineering and phishing simulation
• Endpoint and EDR evasion techniques
• OT/ICS security testing
• Familiarity with one or more of the following frameworks and methodologies:

MITRE ATT&CK

CBEST, TIBER-EU and/or STAR-FS threat intelligence-led testing frameworks

CHECK and CREST testing standards

NIST CSF

CIS Critical Security Controls

ISO 27001

• Understanding of defensive controls and security operations, and the ability to assess their real-world effectiveness against attacker behaviour.
• Ability to quickly understand unfamiliar environments and identify the exposures that most matter to the business.
• Experience identifying and assessing cyber risks within sophisticated environments, with the ability to communicate technical findings and business implications to both technical and non-technical stakeholders.
• Strong analytical and problem-solving skills.
• Commercial awareness and the ability to understand business implications of technology and security decisions.
• Excellent written and verbal communication skills with the ability to convey sophisticated technical concepts to non-technical audiences.

Team & Client Management

• Experience managing technical workstreams and contributing to successful project delivery.
• Strong stakeholder management and presentation skills.
• Ability to engage effectively with both technical teams and senior business executives.
• Experience developing positive client relationships.
• Comfortable working within multidisciplinary and global teams and fast-paced consulting environments.
• Ability to manage multiple engagements and competing priorities.
• Highly organised with strong attention to detail and quality.

Highly Desirable

• Experience scoping, leading or quality-assuring red team or penetration testing engagements.
• Exposure to attack path analysis, exposure management or cyber risk quantification platforms.
• Experience in threat intelligence, purple teaming or detection engineering.
• Experience writing executive-level reports or debriefing senior stakeholders on testing outcomes.

Industry-recognised certifications, such as

CREST CCT Inf / CCT App / CCSAS / CCSAM

OSCP / OSEP / OSCE3

CRTO / CRTL

GIAC GPEN / GXPN

CHECK Team Leader or Team Member

CISSP

• Experience working with private equity-backed businesses or large corporate organisations.
• Experience mentoring junior team members or supporting team development initiatives.
• Interest in business development and market-facing activities. Experience or interest in line management.
• Interest in supporting client relationship management.

What Success Looks Like

• Delivering high-quality, technically robust, threat-informed cyber reviews for private equity and corporate clients.
• Acting as the go-to adversarial perspective across engagements.
• Building trusted relationships with client technology, security and business stakeholders.
• Providing insightful, commercially relevant recommendations that support investment and operational decision-making.
• Contributing to the growth and development of the Digital M&A Advisory practice and its technical capabilities.
• Supporting the development of junior colleagues and enhancing team capabilities.

#li-nw1

2587995