Security Governance & Assurance Specialist

Duration: 6 months +

Location: London, on-site requirements once every 2 weeks / when required by customer

Security Clearance required

The Emergency Services Network (ESN) is a major strategic priority for our client and our commitment to connect for good for our customers and our country. The Security of the ESN is key to our customer and to our Emergency Services users. Availability of the network is a matter of life or death to the Emergency Services and they have to have confidence in the confidentiality and integrity of their communications and operations. We have to build and maintain effective security controls to prevent and detect a wide range of cyber and physical threats.

This job matters because it:

• Contributes to the ESN Security Management Plan, ISMS and Security Processes – ensuring effective management of security within the Programme and that Contract obligations are met.
• Identifies security threats to ESN and ensures the adequacy of processes and controls in place to mitigate them.
• Works with other Security professionals and other teams to meet ESN security objectives.
• Engages with Customer security teams, providing assurance that Security requirements are met and identifying opportunities for improvement.

In support of the above, the ESN Cyber Security Governance & Assurance Specialist executes a range of workstreams in delivering contributions, ESN Programme's and the Customer's overall cyber security risk management program, which is designed to ensure that the technology systems and data associated with the ESN are adequately protected.

The ESN Cyber Security Governance & Assurance Specialist shall:

• Identify and understand all elements of contractual security obligations for the ESN Contract.
• Deliver and verify the implementation of end to end security services as defined within specified the ESN contracts.
• Deliver and implement ISO27001 compliant security strategies, policies, procedures, processes, threat identification & responses that provide wrap-around security services and solutions for the ESN service.
• Deliver the required Security accreditation for the ESN contract.
• Manage operational risks related to people, information, assets, revenues and reputation and ensure compliance with relevant security requirements, typically: the HMG Security Policy Framework, Contractual Obligations, company security and business continuity policies.
• Monitor and manage third party supplier compliance to the flow-down of contractual obligations from the client.
• Monitor and manage security awareness within the ESN Programme.

Skills required:

• Customer-Facing: Ability to establish trusted relationships and successful partnerships with internal and external customers. Be experienced in communicating and influencing across all levels. Be commercially aware.
• Assurance: Ability to plan and execute assurance activities on time, budget and quality: Plan and organise your own work effectively and meet agreed delivery targets. Identify and assess security risks and evaluate mitigations. Understand contractual obligations, their flow down to 3rd parties and the ability to plan and execute assurance reviews to ensure these requirements are being met. Write assurance artefacts, reports and other documents to a high standard, supported by reliable and relevant evidence.
• Operate: Have a proven track record in security and information risk management. Have knowledge and experience of the following: ISO27001, NIST Cyber Security Framework (CSF), National Cyber Security Centre (NCSC) and National Protective Security Authority (NPSA) Standards and Guidance.

MANDATORY experience required:

• Security clearance to BPSS level as a minimum.
• Be experienced in working in an information assurance role on large-scale contracts ideally for Central Government departments or agencies.
• Have proven experience in the writing of assurance artefacts as security accreditation evidence (RMADS) and Security Operating Procedures (SyOPs).
• Experience of administering security processes.
• Experience of carrying out assurance activities and writing reports and recommendations.
• Experience working with ISO27001 controls and audit.

PREFERRED:

• Prior experience working on complex HMG contracts.
• Experience in auditing and security accreditations.
• Experience of working with Telecoms Security Act (TSA) requirements.
• IT security/network experience.
• Have a proven track record in security management (2-3 years).