Cyber Risk Lead (Legacy Coordination and Assurance) - Government Digital Service - G7

Manchester Digital; Manchester; On-site; GBP 60,000 - 90,000; Full time

Job summary

The Government Cyber Unit is recruiting for a Cyber Risk Lead (Legacy Coordination and Assurance). The role requires translating the Government Cyber Action Plan into actionable legacy remediation across government, working with OCTO and the Digital Transformation teams.

It is a strategic, non-technical role focused on governance, risk, and cross-government delivery. Candidates should be able to connect workstreams, translate complex information for senior leaders, and maintain effective

Qualifications

• Demonstrate analytical and strategic thinking connecting risk to governance and planning.
• Ability to build and sustain relationships with diverse stakeholders across teams.
• Capable of translating complex information into actionable guidance for delivery teams.
• Experience with governance, assurance and cross-government programmes.
• Knowledge of cyber security, digital transformation, technology risk or resilience.

Responsibilities

• Act as the primary interface between Accountability and Assurance functions and OCTO on legacy-facing and technology modernisation work.
• Develop relationships across GCU, OCTO and wider stakeholders in government.
• Translate GCAP outcomes and assurance requirements into practical legacy remediation tasks.
• Create clear understanding of legacy risk from assurance activities and programmes.
• Identify lessons from successful remediation to inform programme delivery.
• Collaborate with TRG to align legacy initiatives with risk priorities and appetite.

Skills

Analytical thinking

Strategic thinking

Risk management

Stakeholder management

Governance thinking

Cyber security knowledge

Job description

Location

Bristol, London, Manchester

About The Job

Job summary

This role will require the post holder to have SC clearance to start and may be required to undergo Developed Vetting (DV) once in post, therefore successful candidates will be expected to either hold this or be willing to undertake the DV clearance process once in post.

More information on DV clearance is linked here

The Government Cyber Unit's mission is to protect public services from cyber threats and digital resilience failures. We are working to achieve a step change in our cyber and digital resilience across government, through delivery of the Government Cyber Action Plan, and working closely with departments and national technical authorities including the National Cyber Security Centre to deliver. This is a challenging time to be working in cyber security and digital resilience, but we have an incredible opportunity to make a difference to people’s lives and promote national security by protecting the public services and national infrastructure they rely on. We work at the forefront of shaping the UK’s national response to emerging cyber and technology issues - from the increasingly complex range of state-sponsored cyber-attacks and supply chain compromises, through to the transformational benefits and security challenges of frontier AI and quantum computing.

We work closely with the Office of the Chief Technology Officer (OCTO), the directorate responsible for delivering key government technology strategies and initiatives, like the market-shaping Cloud Challenge Book and public sector technology learning through Get Tech Certified. Led by the Government Chief Technology Officer, OCTO sets cross-government technology strategy, technical standards, and shared architectural patterns to drive digital transformation and interoperability across public services.

The problems OCTO is solving

Government runs on technology the public relies on every day, but much of it is ageing, fragmented, and at risk. While government technology has real strengths, its maturity varies significantly across teams, services, and organisations. Some areas are modern, well-run and highly capable; others are still dependent on old systems, fragile infrastructure, and accumulated legacy and technical debt. That's where we come in: our mission is to build Firmer Foundations for Government, a core pillar of the Government's Blueprint for Modern Digital Government. OCTO is working with leaders across government and the wider public sector to mitigate the risks of legacy and ageing technology. New and emerging technologies are part of the answer. They offer better ways to design, build and run services and improve resilience for the public.

Job Description

Former DSIT recruitment campaigns are continuing as usual, but candidates should be aware that following the Government’s announcement on the changes to some civil service departments, roles will be subject to the machinery of government moves and will ultimately be in one of the new departments. We will provide more information if you are selected for a role. This work remains of high importance to the civil service, and we thank you for your continued interest.

As Cyber Risk Lead (Legacy Coordination and Assurance) you will guide the delivery of legacy and assurance activity, translating the requirements of the Government Cyber Action Plan (GCAP) and Firmer Foundations programme into meaningful actions that drive legacy technology interventions and remediation across government.

This role will work across the Accountability and Assurance functions of the Government Cyber Unit (GCU), and the Firmer Foundations of the Office of the Chief Technology Officer (OCTO) – Digital Transformation, Government Digital Service. This role is not primarily a technical specialist or reporting role, it is a strategic integration role for someone who can understand digital, technology and cyber processes, connect workstreams, deliver requirements into delivery teams, and turn complex technical and programme information into clear advice and action to drive forward progress.

Specific Responsibilities To Include

• acting as the primary interface between the Accountability and Assurance functions of GCU, and OCTO on legacy-facing and relevant technology modernisation work
• developing strong working relationships across GCU, OCTO, Government Departments, Mayoral Strategic Authorities and wider stakeholders
• translating GCAP outcomes, accountability priorities and assurance requirements into practical requirements for legacy remediation delivery
• developing government’s understanding of legacy risk by bringing together insights from assurance activities, legacy remediation programmes, public sector engagement and broader governance activities
• identifying lessons emerging from successful legacy remediation and legacy reduction activity across the public sector and embedding them in programme delivery
• identifying opportunities for legacy technology interventions to support GCAP outcomes
• identifying where legacy technology risks intersect with wider cyber, operational and organisational risks, ensuring these connections inform policy, governance and assurance activity
• working with the Technology Risk Group (TRG) to align legacy technology initiatives with strategic risk priorities, agreed risk appetite approaches and wider technology risk management objectives

The post holder may be required to support out of hours on call rotas for responding to cyber and digital resilience incidents, for which renumeration and/ or flexible working arrangements will be available.

Person specification

We’re Interested In People Who Can

• demonstrate analytical and strategic thinking skills relating risk to corporate governance, organisational strategic direction and planning
• build strong relationships with stakeholders across teams, communicating tailored threat information to relevant stakeholders, organisations and stakeholder groups
• identify connections, dependencies and opportunities across multiple workstreams
• translate and communicate complex information to technical and non-technical stakeholders, including senior leaders championing protective security within the wider security function
• demonstrate experience of governance, assurance and risk management and work on major cross-government programmes
• demonstrate knowledge of cyber security, digital transformation, technology risk or organisational resilience helping organisations to derive and reason their security needs