Cyber Risk Lead (Legacy Coordination and Assurance) - Government Digital Service - G7 in Manchester

Location: Bristol, London, Manchester

Job summary: This role will require the post holder to have SC clearance to start and may be required to undergo Developed Vetting (DV) once in post. Successful candidates will be expected to either hold this or be willing to undertake the DV clearance process once in post.

The Government Cyber Unit's mission is to protect public services from cyber threats and digital resilience failures. We are working to achieve a step change in our cyber and digital resilience across government through delivery of the Government Cyber Action Plan and working closely with departments and national technical authorities including the National Cyber Security Centre.

This is a challenging time to be working in cyber security and digital resilience, but we have an incredible opportunity to make a difference to people’s lives and promote national security by protecting the public services and national infrastructure they rely on.

We work at the forefront of shaping the UK’s national response to emerging cyber and technology issues, from the increasingly complex range of state-sponsored cyber-attacks and supply chain compromises, through to the transformational benefits and security challenges of frontier AI and quantum computing.

We work closely with the Office of the Chief Technology Officer (OCTO), the directorate responsible for delivering key government technology strategies and initiatives. Led by the Government Chief Technology Officer, OCTO sets cross-government technology strategy, technical standards, and shared architectural patterns to drive digital transformation and interoperability across public services.

The problems OCTO is solving: Government runs on technology the public relies on every day, but much of it is ageing, fragmented, and at risk. While government technology has real strengths, its maturity varies significantly across teams, services, and organisations. Some areas are modern, well-run and highly capable; others are still dependent on old systems, fragile infrastructure, and accumulated legacy and technical debt.

That's where we come in: our mission is to build Firmer Foundations for Government, a core pillar of the Government's Blueprint for Modern Digital Government. OCTO is working with leaders across government and the wider public sector to mitigate the risks of legacy and ageing technology. New and emerging technologies are part of the answer. They offer better ways to design, build and run services and improve resilience for the public.

Job Description: Former DSIT recruitment campaigns are continuing as usual, but candidates should be aware that following the Government’s announcement on the changes to some civil service departments, roles will be subject to the machinery of government moves and will ultimately be in one of the new departments. We will provide more information if you are selected for a role. This work remains of high importance to the civil service, and we thank you for your continued interest.

As Cyber Risk Lead (Legacy Coordination and Assurance), you will guide the delivery of legacy and assurance activity, translating the requirements of the Government Cyber Action Plan (GCAP) and Firmer Foundations programme into meaningful actions that drive legacy technology interventions and remediation across government.

This role will work across the Accountability and Assurance functions of the Government Cyber Unit (GCU) and the Firmer Foundations of the Office of the Chief Technology Officer (OCTO) – Digital Transformation, Government Digital Service. This role is not primarily a technical specialist or reporting role; it is a strategic integration role for someone who can understand digital, technology and cyber processes, connect workstreams, deliver requirements into delivery teams, and turn complex technical and programme information into clear advice and action to drive forward progress.

Specific Responsibilities To Include:

• Acting as the primary interface between the Accountability and Assurance functions of GCU and OCTO on legacy-facing and relevant technology modernisation work.
• Developing strong working relationships across GCU, OCTO, Government Departments, Mayoral Strategic Authorities and wider stakeholders.
• Translating GCAP outcomes, accountability priorities and assurance requirements into practical requirements for legacy remediation delivery.
• Developing government’s understanding of legacy risk by bringing together insights from assurance activities, legacy remediation programmes, public sector engagement and broader governance activities.
• Identifying lessons emerging from successful legacy remediation and legacy reduction activity across the public sector and embedding them in programme delivery.
• Identifying opportunities for legacy technology interventions to support GCAP outcomes.
• Identifying where legacy technology risks intersect with wider cyber, operational and organisational risks, ensuring these connections inform policy, governance and assurance activity.
• Working with the Technology Risk Group (TRG) to align legacy technology initiatives with strategic risk priorities, agreed risk appetite approaches and wider technology risk management objectives.

The post holder may be required to support out of hours on call rotas for responding to cyber and digital resilience incidents, for which remuneration and/or flexible working arrangements will be available.

Person specification:

We’re Interested In People Who Can:

• Demonstrate analytical and strategic thinking skills relating risk to corporate governance, organisational strategic direction and planning.
• Build strong relationships with stakeholders across teams, communicating tailored threat information to relevant stakeholders, organisations and stakeholder groups.
• Identify connections, dependencies and opportunities across multiple workstreams.
• Translate and communicate complex information to technical and non-technical stakeholders, including senior leaders.
• Champion protective security within the wider security function.
• Demonstrate experience of governance, assurance and risk management and work on major cross-government programmes.
• Demonstrate knowledge of cyber security, digital transformation, technology risk or organisational resilience helping organisations to derive and reason their security needs.