Cyber Security Threat Hunting Principal

The Office for National Statistics (ONS) is the UKs largest producer of official statistics, covering a range of key economic, social and demographic topics. These include measuring changes in the value of the UK economy, estimating the size, geographic distribution and characteristics of the population, and providing indicators of price inflation, employment, earnings, crime and migration.

The last few years has seen an extensive overhaul of security and information management to meet the challenges of corporate and statistics transformation in technology, methods and practice, the Digital Economy Act and organisational risk appetite. The capability is evolving and expanding to address changes in threat and business direction.

This Cyber Security Threat Hunting Principal role sits within the Security and Information Management (SaIM) Directorate, which operates six key services across ONS: Security Risk Advice and Management; Knowledge and Information Management (KIM); Physical Security and Business Continuity; Security Compliance and Audit (SCA); Cyber Security; and Security Culture Services.

The role will lead in delivering the Cyber Security Threat Hunting function which is part of the Cyber Security division, within the Security and Information Management directorate. 

This will involve having a detailed understanding of the methods used to malicious attackers as well as business understanding to be able to identify unusual and malicious activity. The role will lead on complexity threat hunts to proactively identify potential malicious activity present in the ONS IT estate and vulnerabilities that could be used for malicious activity. Findings from these threat hunts will be reported to the senior leaders in Security and Information Management, Cyber Security Threat Hunting Principal will advice and lead on remediation steps against identified findings and vulnerabilities.

In addition, the role holder will assist in major incident response providing highly skilled resource to the Cyber Security Incident Response Principal when required.

Typical assignments

• Delivering strategic objectives for Cyber Security Threat Hunting function over the three-year Security and Information Management (SaIM) strategy period.
• Conduct Cyber Security Threat Hunting aligned to the cyber threat faced by ONS, scope the threat hunts hypothesis and report the findings to the Head of Cyber Security.
• Identify opportunities to improve the quality of security alerts and work with the cyber analytics to implement changes to alerting, ensuring all teams involved are briefed and appropriate and high-quality documentation is created.
• Identify misconfiguration and other vulnerabilities present in the ONS network, leading the remediation, working with the stakeholders in Vulnerability Management and Digital Services.
• Liaise with other government departments to assist in the identification and remediation of cyber security threats.

Responsibilities

Essential Criteria:

• Experience in developing and implementing cyber security strategy across people, process, and technology.
• Lead large-scale, cross-functional or highly complex cyber security threat hunts to proactively hunt for malicious activity not identified by protective monitoring or vulnerability management.
• Disseminate the implications of Cyber Security Threat Hunting findings and explain the potential business impact if findings are exploited to senior level leadership across government.
• Lead engagement with senior internal and external stakeholders to manage and provide appropriate Cyber Security assurance to the required standard and in accordance with policy and regulations.
• Advise on complex issues and mitigation options to appropriate stakeholders or governance forums, acting as an SME across government, the public sector, and industry.
• Be the key decision maker on reports, overseeing the remediation of vulnerabilities identified during Cyber Security Threat Hunts.
• Proven track record of analysing complex information associated with Cyber Security.

Desirable 

• Working towards or have obtained, relevant professional membership e.g. GIAC, CISSP.