Cyber Security Engineer

Necsu; North East; Hybrid; GBP 60,000 - 85,000; Full time

Benefits offered by this job

Generous holidays and pension

Free car parking

NHS discounts

Job summary

NHS North Of England Commissioning Support Unit is seeking a Cyber Security Engineer to shield critical digital services. The role supports CQRS/SART testing, threat assessment, and assurance across NHSE/I systems.

It involves ethical hacking, incident response, and guidance to stakeholders in a hybrid work setting across home and office locations. Applicants should have a degree in a computing/engineering field and experience with AWS/Azure, WAF, and GuardDuty.

Qualifications

• Experience assessing cyber threats and implementing controls.
• Proven ability to perform security testing (ethical hacking) and incident response.
• Familiar with cloud security controls and security testing in cloud environments.

Responsibilities

• Assess emerging cyber threats and identify vulnerabilities and controls.
• Monitor systems for attacks and unauthorized activity; conduct security testing.
• Develop and execute security test plans and scripts, including testing for web vulnerabilities.
• Provide specialist cyber security advice to technical and non-technical stakeholders.
• Manage firewall and WAF controls in cloud environments.

Skills

Cyber security

Threat assessment

Security testing

Cloud security

Firewall management

Stakeholder communication

Education

Degree in computing/engineering or related

Tools

AWS

Azure

WAF

GuardDuty

Job description

Go back NHS North Of England Commissioning Support Unit

Cyber Security Engineer

The closing date is 18 November 2026

Are you a talented and proactive cyber security professional looking for an opportunity to help protect critical digital services?

We are looking for a Cyber Security Engineer to support the BSA DDAT function. The Cyber Security Engineer is a key role in assessing cyber threats and helping ensure that digital products, applications and systems are secure and operate effectively. The postholder will identify vulnerabilities, undertake security testing, monitor for potential attacks and provide specialist cyber security advice and assurance.

This is a hybrid working role, with the successful candidate working across a mixture of home and office locations.

This vacancy is restricted to employees currently working within a Commissioning Support Unit (CSU). The role is being recruited to support services moving to NHS Business Services Authority (NHSBSA). The successful applicant may therefore potentially transfer to NHSBSA as part of the relevant service transfer arrangements. Further information will be provided as part of the recruitment and transfer process.

This role will close Wednesday 18th November and interviews/selection are expected to take place during the week commencing 23rd November.

For an informal discussion, please contact Mark Chapman at [e-mail].

Main duties of the job

• This role will be responsible for:
• Assess emerging cyber threats and identify vulnerabilities and appropriate controls.
• Monitor systems and services for attacks, intrusions and unusual or unauthorised activity.
• Undertake security testing, including ethical hacking and functional and non-functional testing.
• Develop and execute security test plans and scripts, including testing for common web vulnerabilities.
• Investigate security alerts and support incident response and post-implementation testing.
• Implement cyber security standards and policies and support assurance audits.
• Manage and maintain relevant firewall and web application firewall controls in cloud environments.
• Provide specialist advice, reports, training and recommendations to technical and non-technical stakeholders.

About us

At NECS we are very proud to be part of the NHS England family. We are one of the very few truly customer-owned entities within the NHS. We have grown from our roots in the North East to be an NHS business with customers the length and breadth of the UK and further abroad. Our customer base has diversified significantly over this period, and we are now very pleased to be serving NHS providers as well as commissioners, NHSE regions, Local Authorities, General Practices and national NHSE Directorates.

NECS combines specialist skills and expertise with scale and resilience to achieve required results. We combine core NHS values with a sharp focus on customer care and a relentless pursuit of continuous improvement. We very much see ourselves as a key partner in the future success of the healthcare system and we take our share of the responsibility for shaping effective delivery.

Our people are the heart of our organisation. We strive to ensure they feel trusted, valued and empowered. Were passionate about nurturing and developing people. When you join us, we want you to grow, and we offer many opportunities for you to do that as well as an excellent benefits package including generous holidays and pension plus free car parking and access to NHS discounts.

Job responsibilities

Job Purpose

The role is key in supporting the management and development of Calculating Quality Reporting Service (CQRS) & Systems Applications and Reporting Technology (SART), along with being the liaison for security related testing within the CSU, reporting to the Head of Assurance. As a member of the software engineering division, you will assist in assessing cyber threats. You will be responsible for preventing, finding and reporting any unauthorised cyber-attacks. The role will ensure that all products, applications, and systems work correctly.

Core Duties and Responsibilities (Key Result Areas)

Policy and Service Development

Review and develop an integrated approach to cyber security and support the assurance audits through collation of evidence.

Implement cyber security standards and policies within CQRS & SART in line with corporate processes, proposing changes and enhancements to support continuous improvement.

Planning and Delivery

• Contribute to the operational planning of Agile delivery, identifying interdependencies across functions, potential impacts on wider organisation, resource requirements and building in contingency and adjustments as necessary.
• Keep up to date with the latest security and technology developments.
• Research and evaluate emerging cyber security threats and ways to manage them.
• Monitor for attacks, intrusions and unusual or unauthorized activity.
• Engage in ethical hacking, for example simulating security breaches.
• Identify potential weaknesses and implement measures, such as firewalls and encryption.
• Liaise with stakeholders in relation to cyber security issues and provide future recommendations.
• Design and implement test plans to highly complex requirements provided by NHSE/I and primary care specifications and lead all testing requirements.
• Contribute to the development of assurance team strategies and the development and implementation of improvement programmes in accordance with the CSU.
• Provide advice and support to management and staff on testing/assurance processes, interpreting legislation and suggesting approaches to fulfil requirements.
• Prepare comprehensive documentation and provide training in specialism to demonstrate the testing undertaken and developments to NHSE/I and other involved parties.
• Ensure work undertaken is in line with best practice policies such as the OWASP testing methodology when cyber security testing.
• Review requirements received from customers, analyse user stories and requirements for validity and feasibility, scoping testing resource and timescales.

Staff Management

• Day to day coordination of staff; provide mentorship and support to staff with solution assurance specialisms and being a key contact for testing escalations.
• Provide service wide training on testing protocols both to internal staff and through demonstrations to the customer.
• Where appropriate, assist the Head of Assurance and the IT team in ensuring Testers are responsible for the care, security, maintenance, disposal, and control of equipment assigned to their department.

Assurance Deliverables

• Execute all levels of testing (System, Integration, and Regression) detecting and tracking solution defects and inconsistencies with relation to security.
• Design and develop automation/test scripts (Automation first approach), providing timely solutions and supporting documentation, including test packs for customer(s). Present test evidence and lead discussions around findings.
• Complete all aspects of Functional & Non-Functional testing ensuring collaboration with the development team to develop effective strategies and test plans.
• Complete security test scripts on products such as XSS and SQL injection tests where applicable on products, generating detailed reports for technical and non-technical staff and stakeholders.
• Investigate security alerts and provide incident response, feeding back to relevant parties where necessary.
• Help troubleshoot and resolve issues and conduct post-release/ post-implementation testing.
• Assist with the creation, maintenance and delivery of cyber security awareness training for colleagues.
• Managing and maintaining the Firewalls / WAFs in AWS & Azure.
• Removal of all none official backlinks for all web applications and web monitoring.

Person Specification

Experience

• Experience of working on large scale, complex, tight deadline projects.
• Experience and can provide evidence of working as a Cyber security tester.
• Evidence of post qualifying and continuing professional development.
• Experience in an Agile / SCRUM methodology.
• Experience of AWS & Azure infrastructure.
• Experience with WAF/Firewalls and GuardDuty.
• Experience of working with the NHS.

Interpersonal Skills

• Good communicator with ability to present complex technical issues in a non-technical way.
• Commitment to and focused on quality, promotes high standards in all they do.

Mobility

• Must be able to commit to working outside of core hours, with occasional evening and weekend working.
• Will be required to travel regionally and could lead to early starts or late evenings to make meetings as a result or occasional overnight stops in hotels.
• Will be required to travel regionally, resulting in early starts, late evenings, or occasional overnight stops in hotels to attend meetings.
• Car driver / owner or reasonable alternative.

Skills / Abilities

• Methodical thinking.
• Having methods for problem solving.
• Being a good communicator, both written and spoken.
• Competent teamwork abilities.
• Ability to create concise, effective test documentation. Accurate defining of defects.
• Analytical thinking abilities.
• Being self-motivated.
• Having a competent judgment to inform problems to superiors on time.
• Familiarity with Agile frameworks and regression testing.
• Ability to document and troubleshoot errors.
• Working knowledge of test management software.
• Strong organizational skills.

Knowledge

• Must be committed to self-development and be enthusiastic about acquiring new skills and embracing new technologies.
• Proven ability and experience of successfully testing digital products and/or services within tight timescales.
• Needs to have a thorough understanding of and commitment to equality of opportunity and good working relationships both in terms of day-to-day working practices, but also in relation to management systems
• Understanding of NHS structure and its constituent organisations.

Qualifications

• Educated to Degree or equivalent level in a computing, engineering, analysis or related subject or relevant experience.
• Awareness of equality, and valuing diversity principles.
• Understanding of Confidentiality and Data Protection Act.
• The promotion of equality of opportunity and good working relations (providing practical leadership).
• Beneficial skills would include:
• Understanding of the not-for-profit sector.
• Familiar with software and database technology.

Employer name

NHS North Of England Commissioning Support Unit