Commercial Security and Information Assurance Lead

The Cabinet Office and HM Treasury operate at the heart of the UK government. These iconic departments are responsible for ensuring the effective running of government, maintaining control over public spending and working to achieve strong and sustainable growth for the UK.

The Cabinet Office & HM Treasury (COHMT) Commercial team has a vision to be a top performing commercial function in government, setting best practices for others to follow. It offers a unique challenge to commercial professionals who want to work on some of the UKs most important policy issues. The team works in partnership with all areas of the business, providing a commercial service that covers planning, commercial strategy, sourcing and contract management on circa 1bn of third party spend.

We are looking for an experienced Information Assurance/Cyber Security professional to join the team. This role will be responsible, alongside the Head of Commercial Information Assurance, for working with Business Units and the Commercial Team to ensure that Cabinet Office contracts have proportionate and robust contractual security requirements included in each procurement and that security elements of large contracts are successfully managed. This role will be challenging and hands-on, and will require expert knowledge of security architectures, information assurance and information risk management. Some knowledge of commercial processes and supply chain management from a security perspective is desirable.

You'll support the Head of Commercial Information Assurance to deliver secure outsourced services and systems. This includes providing specialist advice and expertise for risk management decision making by senior risk owners.

The role involves supporting both projects procured for Cabinet Office themselves and those procured by Cabinet Office for use by the rest of government. The role involves working closely with suppliers, commercial teams, legal advisors, and colleagues from across the public sector.

The post sits in the Commercial Directorate and reports to the Head of Commercial Information Assurance. This role will require close working relationships across all the Business Units in the CO and across HM Government to ensure departmental and cross departmental information risks are assessed and effectively managed. This specialist role requires technical cyber security and risk management skills and knowledge. This role can be based in London, York, Glasgow, or Manchester and allows for hybrid working arrangements with a minimum of 3 days in the office per week. An additional digital skills payment may be applied for with a technical skills assessment which is reviewed annually.

Key responsibilities include:

• Provision of Information Assurance advice to Cabinet Office procurements and projects/services for which Cabinet Office acts as the Authority for HMG.
• To ensure appropriate Information Assurance (IA) controls are applied by service providers to reduce the information risks to an acceptable level to the Cabinet Office.
• Review of supplier system security architectures and controls to determine likely effectiveness.
• Provide recommendations on risk acceptance to the Head of Commercial IA where outside of the Cabinet Office risk appetite
• Ensure appropriate contractual mechanisms are in place to ensure suppliers can be held to account to manage security effectively in order to protect Cabinet Office, civil servant and citizen data.
• Provide direction to commercial teams on the security requirements for projects/programmes. To include specifying and drafting security requirements to be included in procurement documentation, along with assisting programs with bid evaluations, supplier negotiations and contract management.
• Assist the Head of Commercial IA with providing instructions to internal or external legal counsel on the drafting and development of the security elements of contract suites.
• Assist projects/programmes with the risk assessment and mapping of technical, personnel, procedural and physical controls to reduce risks to a level acceptable to the Senior Risk Owner.
• Manage the security aspects of new and existing contracts throughout the project lifecycle to ensure security risks are managed to acceptable levels and in line with the contract clauses.
• Provide and document security advice to internal as well as cross-departmental projects and programmes in CO to effectively manage their shared risk management requirements.
• Provide security risk advice and support to the Project Manager/Board and the Senior Risk Owner, either in the Cabinet Office or the lead department.
• Take account of differences in customers' risk appetite and balance their business drivers against appropriate levels of security from a strategic HMG perspective.
• Work closely with other IA technical specialists and leverage their assistance when required.
• Reviewing security documentation and technical security architectures provided by suppliers.

Essential criteria

• Have sound knowledge and experience of assessing technical security architectures and technical security controls.
• Have demonstrable extensive experience of all aspects of Information Assurance and Information Risk Management.
• Have experience of dealing with a diverse group of stakeholders with sometimes conflicting security/business requirements.
• Have experience of engaging with senior personnel within the public and private sector.
• Hold a formal information security qualification such as an MSc in a related field, CISSP, or ISO 27001 Lead Auditor or be able to demonstrate equivalent knowledge and experience.
• Must be willing to undergo Security Check (SC) vetting.

Desirable criteria

• Knowledge of the security accreditation/assurance process for some higher classification projects.
• Have previous experience of working with suppliers and commercial teams to deliver the security elements of procurement within tight deadlines.
• Experience of assessing cloud security controls.

Additional information:

Cabinet Office policy is that a minimum 60% of your working time should be spent at your principal workplace. For some roles, due to their nature and the business need, this may be up to 100%. Requirements to attend other locations for official business will also count towards this level of attendance.