Security Compliance Policy Associate

The Office for National Statistics (ONS) is the UKs largest producer of official statistics, covering a range of key economic, social and demographic topics. These include measuring changes in the value of the UK economy, estimating the size, geographic distribution and characteristics of the population, and providing indicators of price inflation, employment, earnings, crime and migration.

Security and Information Management (SaIM) directorate operates five key services across ONS: Security Risk Advice and Management; Knowledge and Information Management (KIM); Physical Security and Business Continuity; Security Development, Compliance and Audit; and Cyber Security, including our Partnering Services. 

This Security Compliance Policy Associate role sits within the Security Development, Compliance and Audit (SDCA) team which forms part of the Security and Information Management (SaIM) directorate. The SDCA team provides an advice service to stakeholders for the complete lifecycle, security and governance of sensitive information stored within data access environments. The SDCA team also acts as an interface between stakeholders to deliver data protection assurance, monitor compliance with security policies and principles as well as provide evidence to stakeholders in support of these functions.

The primary focus of this role is the implementation of data protection assurance and audit capabilities within the Security Compliance team, in line with clearly defined security strategy and data protection standards. This also includes advising internal users, stakeholders and Information Asset Owners on compliance and risk associated with use of data.

You may be expected to identify and assess the risk(s) associated with the event / incident, raise awareness, and ensure appropriate steps are taken to record and manage any associated risks. Or you may assist planning and conducting audit. You will escalate any concerns/risks to the senior managment.

Responsibilities

• Support Compliance Policy Lead in developing and implementing effective data protection assurance processes and compliance documentation (e.g. DPIAs, SyOPs, etc.) to meet regulatory and legal requirements.
• Support in developing and implementing effective auditing and monitoring capability for data systems and data use which incorporates advice from Security and industry best practice.
• Establishing understanding of the nature, scope, context, purposes, and risk of data processing by different business areas to provide comprehensive guidance and effective oversight of compliance.
• Support in developing and promoting effective training, engagement, and awareness-raising activities to promote data protection and compliance best practice.
• Assisting with the investigation of non-compliance incidents and breaches and taking actions as directed.
• Supports Asset, Security, Information Management and Account responsibilities for the use of all ROSA assets in ONS possession.

Essential Criteria

• Ability to extract, analyse and visualise information to produce metrics, identify trends and make predictions that inform assessments of risk associated with the use of Government data.
• Awareness of UK Government Security Policy Framework and relevant Information Assurance Standards, e.g. ISO 27001, Data Protection Act.
• Working knowledge of data protection legislation and regulations, including understanding of their implementation in different contexts across Government.
• Working knowledge of risks associated with the use of Government data for statistical production, with ability to provide advice on appropriate data use, risk mitigation and disclosure control.
• Excellent written and verbal communication skills at different levels; ability to effectively communicate complex topics to non-specialist audiences.

Desirable

• Holding or willing to work towards professional development qualifications within specialist Security discipline e.g. ISO 27001 Security Auditor etc.