At a Glance
- Tasks: Drive information security risk management and protect vital public services.
- Company: Join Social Security Scotland, a key agency of the Scottish Government.
- Benefits: Enjoy flexible working, competitive pay, and a supportive environment.
- Other info: Great career growth opportunities and a diverse, inclusive workplace.
- Why this job: Make a real difference in cyber security for communities across Scotland.
- Qualifications: Knowledge of security standards and risk management experience required.
The predicted salary is between 63000 - 77000 £ per year.
Are you ready to drive effective information security risk management for a vital public service? Join us as a Security and Information Risk Advisor within our Digital Risk & Security branch, where your expertise will guide our commitment to protecting Social Security Scotland. If you are passionate about cyber security and have a keen interest in safeguarding critical information, join our talented team and take the next step in your career.
Typical Role Level Expectations
- Provide advice and guidance on security strategies to manage identified risks and ensure adoption and adherence to standards.
- Obtain and act on vulnerability information and conduct security risk assessments and business impact analyses on complex information systems.
- Investigate major security breaches and recommend appropriate control improvements.
- Contribute to development of information security policy, standards and guidelines.
- Interpret information assurance and security policies and apply these to manage risks.
- Use control testing information to support information assurance assessments.
Responsibilities
- Conduct risk-based assurance reviews of internal solutions and third-party suppliers, assessing control effectiveness, identifying risks and vulnerabilities, and recommending remediation activities to support compliance and informed risk-based decision-making.
- Manage complex risks, issues, remediation activities, and lessons learned, applying appropriate risk methodologies and advising on risk impact, tolerance, and mitigation strategies.
- Design and review secure system architectures, applying architectural principles, patterns, and appropriate levels of rigour to deliver effective business outcomes.
- Assess the impact of vulnerabilities, emerging technologies, and developments in security technologies on existing and future systems, recommending appropriate responses and controls.
- Build and maintain effective stakeholder relationships, managing expectations, resolving issues, and facilitating discussions on complex or high-risk matters, often within challenging timescales.
- Represent the security profession and communicate complex technical and risk concepts to a wide range of audiences, both internally and externally.
- Apply knowledge of systems, security, policy, business architecture, and legal or regulatory requirements to develop secure technical solutions and controls.
Success Profiles
We use an assessment framework called ‘Success Profiles’ which lists the elements we test and provides detailed descriptions of each. For this post, the following Success Profile elements will be assessed:
- Experience: Knowledge of information security standards like ISO/IEC 27001 and NIST SP 800-53, combined with understanding of current legislation such as DPA 2018 and GDPR. Proven ability to interpret and apply these standards and legal requirements to ensure compliance and integrate best practices into organisational operations. Demonstrable ability to evaluate the effectiveness of technical, physical, procedural, and personnel controls, recommend improvements, and work with stakeholders to implement proportionate risk mitigation measures that strengthen the organisation's overall security posture.
- Behaviours: Communicating and Influencing - Level 3; Delivering at Pace - Level 3.
Technical/Professional Skills
This role is aligned to Security and Information Risk Advisor within the Government Digital and Data Profession. These skills will be tested during the Technical Assessment if you are successful at sift stage. They will not be assessed at application stage.
Information Session
We are holding a candidate information session for this role to provide you with information about the application and interview process as well as further information on the role and team.
Expected Timeline (subject to change)
- Sift – week commencing 31st August 2026
- Interview – week commencing 21st September 2026
Location: In Person in either Dundee or Glasgow.
Reserve List: In the event that there are more successful candidates than posts available, a reserve list will be kept for up to 12 months.
About Us
Social Security Scotland is an Executive Agency of the Scottish Government. Our benefits help people from all walks of life in Scotland. We offer rewarding careers and employ people across Scotland in a wide range of professions and roles. We are committed to recruiting a diverse workforce that is representative of the clients we serve. We offer a supportive and inclusive working environment along with a wide range of employee benefits.
Working Pattern
Our standard hours are 35 hours per week and we offer a range of flexible working options, depending on the needs of the role. We embrace a hybrid working style where all colleagues will spend time in either our Glasgow or Dundee offices. There is an expectation of a minimum 2 days per week in your assigned location, which will be either Glasgow or Dundee.
Security checks
Successful candidates must complete the Baseline Personnel Security Standard (BPSS) before they can be appointed. This post requires the successful candidate to clear additional National Security Vetting clearance before a start date can be offered.
Equality Statement
Social Security Scotland are committed to equality and inclusion, and we aim to recruit a diverse workforce that reflects the population of our nation. We are a Disability Confident Employer.
Right to Work in the UK
Social Security Scotland is an approved sponsor under the UK Visa and Immigration (UKVI) Skilled Worker route.
Further Information
Social Security Scotland’s recruitment processes are underpinned by the recruitment principles of the Civil Service Commissioner, which outline that selection for appointment be made on merit on the basis of fair and open competition.
If you feel at any time your application has not been treated in accordance with the values in the Civil Service Code, you can make a complaint by contacting Social Security Scotland in the first instance.
The successful candidate will be expected to remain in post for a minimum of 3 years unless successful in gaining promotion to a higher Band or Grade.
Apply before 23:55 on Monday 31st August 2026.
Contact Name: Resourcing Team
Contact email: Recruitment@socialsecurity.gov.scot
Security and Information Risk Advisor in Glasgow employer: Social Security Scotland
Social Security Scotland is an exceptional employer dedicated to making a positive impact on people's lives while fostering a supportive and inclusive work environment. As a Modern Apprentice in Dundee, you will benefit from comprehensive training, gain valuable experience in the civil service, and have access to opportunities for personal and professional growth, all while contributing to the vital mission of delivering social security benefits across Scotland.
StudySmarter Expert Advice🤫
We think this is how you could land Security and Information Risk Advisor in Glasgow
✨Get Involved in the Cybersecurity Community
Diving into the cybersecurity community is key for landing that full-time gig. Join forums like Reddit's r/cybersecurity or attend local meetups to connect with industry veterans and other job seekers. Networking is everything in this field—don’t just be a passive lurker!
✨Show Off Your Skills with Capture the Flag Competitions
Participate in Capture the Flag (CTF) competitions; these are not just a fun way to boost your skills but also a chance to showcase your talent to potential employers. Many companies, including Social Security Scotland, love seeing candidates who actively engage in these challenges.
✨Tailor Your Online Presence
Make sure your LinkedIn and any professional profiles reflect your cybersecurity expertise. Share your projects, whether they’re personal or from a previous role, to catch the eye of hiring managers. This is how they’ll find your passion and commitment to the field!
✨Apply Directly Through Social Security Scotland
Don’t forget to head straight to our website and check out any openings for cybersecurity roles at Social Security Scotland. Applying directly can sometimes give you an edge, especially if you can mention that you've been following our work or engaging in the community.
We think you need these skills to ace Security and Information Risk Advisor in Glasgow
Some tips for your application 🫡
Show off your technical skills:In cybersecurity, it's crucial to highlight your technical prowess. Make sure your CV showcases specific skills like network security, penetration testing, or threat analysis. If you have relevant certifications (like CEH or CISSP), pop those on the front page to grab attention!
Tailor your portfolio for the role:Even for a full-time role, a portfolio can set you apart. If you've worked on any cybersecurity projects—be it CTF challenges, security assessments, or research papers—include these in your application. This demonstrates not just your skills, but also your hands-on experience!
Use real-world examples:When writing your cover letter, don’t just stick to your qualifications. Share real-world examples of how you’ve tackled security issues or vulnerabilities. This gives the hiring team at Social Security Scotland insight into your practical problem-solving abilities and makes your application memorable.
Demonstrate your passion for cybersecurity:Cybersecurity is an ever-evolving field, so show us that you’re always learning! Mention any recent courses, webinars, or industry events you’ve attended. This not only exhibits your enthusiasm but also signals to Social Security Scotland that you’re committed to staying ahead in the game.
How to prepare for a job interview at Social Security Scotland
✨Sharpen Your Technical Skills
For a role in cybersecurity, it’s essential to be up-to-date with the latest tools and techniques. Brush up on your knowledge of firewalls, intrusion detection systems, and vulnerability assessment tools. Be ready to discuss specific scenarios where you’ve applied these skills, as hands-on experience can really set us apart in interviews.
✨Prepare for Scenario-Based Questions
Expect the interviewers at Social Security Scotland to throw in some hypothetical situations to see how you’d handle them. Think about common security breaches or incidents and be prepared to explain how you would respond. This not only shows your problem-solving skills but also your understanding of real-world cybersecurity challenges.
✨Highlight Your Certifications
Certifications like CompTIA Security+, CISSP, or CEH can give you a significant edge in a full-time role in cybersecurity. Make sure to mention these during your interview and be prepared to discuss what you learned through those certifications and how they relate to the position at Social Security Scotland.
✨Show Your Passion for Cybersecurity
Since you’re going for a full-time gig, showing genuine enthusiasm for the field can make all the difference. Share any personal projects, blogs, or communities you’re part of that relate to cybersecurity. This not only showcases your passion but also your commitment to staying engaged in this ever-evolving field.
