Cyber Security Risk Manager Lead

The Office for National Statistics (ONS) is the UKs largest producer of official statistics, covering a range of key economic, social and demographic topics. These include measuring changes in the value of the UK economy, estimating the size, geographic distribution and characteristics of the population, and providing indicators of price inflation, employment, earnings, crime and migration.

The last few years has seen an extensive overhaul of security and information management to meet the challenges of corporate and statistics transformation in technology, methods and practice, the Digital Economy Act and organisational risk appetite. The capability is evolving and expanding to address changes in threat and business direction. Security and Information Management Directorate (SaIM) operates five key services across ONS: security risk advice and management; knowledge and information management (KIM); physical security and business continuity; security compliance and audit; security operations including our Security Operations Centre.

The Cyber Security Risk Manager - Lead roles forms part of the Security Risk Advisory team within the Security and Information Management Division at the Office for National Statistics (ONS). The roles reports to the Cyber Security Risk Manager - Principal. The primary focus of these roles are to provide the Organisation with security advice and best practice to develop Secure by Design protections for organisational assets and embed the ONS Security Framework - principles; policies; processes; threat model; security risk management into the ONS.

These roles will be dedicated to supporting all security assessment and assurance activities associated with the preparation and delivery of UKSA digital programmes, such as Census 2031. Key activities will involve security assessment, assurance, threat modeling and mitigation advice/guidance for all aspects of digital delivery, including in-house and procured/third-party elements. Key outcomes from the roles are the identification of security risk within the business context, the identification of appropriate mitigation approaches for business selection and the management of these options through to implementation within the live service. The security advice provided will be informed by threat, vulnerability and risk analysis for business and third parties. The focus, outcomes and responsibilities are aligned to the Government Security Profession framework of the Cyber Security Risk Manager Lead.

Government Security Profession - Career framework

Responsibilities

• Supporting the development of business-focused security solutions for digital products and business operations that cover data collection, storage and processing of Official - Sensitive information (deployed both internally and via external suppliers);
• Identifying security threat and risk to the Organisation's digital products, data assets and business operations as part of the delivery lifecycle;
• Lead the analysis and derivation of business-supporting security needs, undertake Cyber Security related risk assessments, conduct tailored threat assessment and other risk management activities, and ensure activities are consistent with applicable regulations and legislation;
• Independently undertake risk management activities within a given area of practice or expertise, usually within established security and risk management governance structures;
• Lead the analysis and derivation of business-supporting security needs, undertake Cyber Security related risk assessments, conduct tailored threat assessment and other risk management activities, and ensure activities are consistent with applicable regulations and legislation;
• Consulting with the Organisations security stakeholders to ensure that the solutions deployed are secure and fit for purpose;
• Liaising with the Organisations business, technology and security colleagues to ensure various business needs are understood and applied, including providing general security architecture, guidance and advice to the stakeholders;
• Advising on opportunities for using secure and open-source products and any implications of such an approach.
• Ensure that security policies and security controls remain appropriate and proportionate to the assessed risks, and are responsive and adaptable to the changing threat environment, business requirements and ONS policies;
• Provide tailored advice to a range of stakeholders on how to remedy identified risks by proportionately applying security capabilities, using published guidance, standards, and drawing on a range of experts as well as personal expertise;
• Provide expert security advice that highlights Cyber Security related risks, so risk or service owners can make well-informed and auditable decisions.

Essential Criteria:

• Extensive expertise in cloud, application, infrastructure and networking security controls, with strong proficiency across cyber, physical, procedural and technical (ICT) security domains, particularly in relation to secure data management.
• Proven experience delivering high quality security advice and technical security solutions within a UK Government Department, supporting complex operational and digital environments.
• Strong working knowledge of UK Government security frameworks and standards, including the Government Security Policy Framework (SPF), ISO 27001, and the Data Protection Act (DPA).
• Commitment to professional development, ideally working towards relevant certifications such as CESG Certified Professional (CCP) at Senior Practitioner level and/or membership of professional bodies such as the British Computer Society (BCS).
• A successful track record of leading and influencing the implementation of security frameworks (e.g., Secure-by-Design) in multi-disciplinary environments.