Cyber Security Risk Manager

UK Ministry of Defence; London; Hybrid; GBP 59,000 - 70,000; Full time

Job summary

An exciting opportunity within a high-profile government unit, focusing on cyber security and resilience. You will lead the Cyber Security team, developing strategies to mitigate evolving threats while ensuring compliance with national policies. This role offers the chance to shape the future of cyber security within the Defence sector, collaborating with key stakeholders and managing a dedicated team. The position supports professional development and offers a competitive salary along with a generous benefits package, including a Digital Skills Allowance. Join a mission-driven environment where your expertise will make a significant impact.

Benefits

Civil Service Pension

25 days annual leave

Learning and development opportunities

Digital Skills Allowance

Flexible working arrangements

Parental and Adoption Leave

Discounts on services

In-year rewards and recognition schemes

Support for continuous professional development

Culture promoting inclusion and diversity

Qualifications

• Experience in developing a Cyber Security Strategy and resilience programme.
• Ability to lead and manage a team effectively.
• Strong networking and relationship-building skills.

Responsibilities

• Lead DOS cyber security and resilience risk assessments.
• Implement Cyber Compliance Framework across DOS.
• Manage cyber incidents and coordinate with security teams.

Skills

Cyber Security Strategy

Risk Management

Stakeholder Management

Team Leadership

Communication Skills

Education

Certificate in Information Security Management Principles (CISMP)

Certified Information Security Systems Professional (CISSP)

Certified Cyber Professional (CCP)

Job description

MOD Main Building, Whitehall, London SW1A 2HB

Job Summary

The Ministry of Defence (MOD) Main Building is MOD’s flagship headquarters, enabling the four pillars of Defence: the Department of State, Military Strategic Headquarters, National Armaments Director Group and the Defence Nuclear Enterprise.

This is an exciting new high-profile role within the Safety, Security, Business Resilience, Technology and Accommodation (SSBRTA) business unit. The main purpose is to oversee the safety, security and resilience of MOD Main Building, ensuring that staff can continue to deliver critical Defence outputs, in all foreseeable circumstances.

We are looking for an enthusiastic individual to lead the Department of State (DOS) Cyber Security team, working across the whole of Defence, covering a range of security and resilience delivery functions.

This position is advertised at 37 hours per week.

Job Description

In this role, you’ll be required to develop a Cyber Security Strategy for the DOS, aligning with Defence’s Cyber Security Strategy and Resilience programme. You’ll lead the work to understand cyber security and resilience risk of the DOS, ensuring the effectiveness of proposed mitigations against an evolving cyber threat.

You’ll promote and advise on best practice and secure by design, ensuring DOS business units are aligned and comply with MOD policy and lead on the implementation of Cyber Compliance Framework activities, driving forward improvements as required. Liaising with key stakeholders, you’ll ensure we are coherent with wider departmental work and objectives and represent the Principal Security Advisor at departmental meetings.

You may also be required to support management of security (cyber) or resilience incidents, including managing crises that disrupt, or have the potential to disrupt, business in Main Building. You’ll need a wider awareness of changing priorities, distinguishing the preferable from the critical and, as a new team, you’ll have an opportunity to shape responsibilities against identified priorities, over the next 5 years.

Sharing the responsibility of providing out of hours advice to Main Building users and stakeholders, you may be required to take part in an on-call rota, with colleagues across the SSBRTA team, for which an allowance is payable.

Responsibilities

• Lead work to understand DOS cyber security and resilience risk, ensuring effectiveness of proposed mitigation against the evolving cyber threat.
• Ensure DOS conducts cyber risk assessments and risk management, providing advice and guidance to senior management, business units and key stakeholders on cyber security and resilience related risks.
• Lead the implementation of the Cyber Compliance Framework and the Cyber Risk Management Framework across DOS, building a cyber risk management community of interest and using it to promote cyber risk knowledge sharing.
• Ensure DOS implements Defence / Government cyber security guidance, policy and tools, overseeing the analysis of mitigation plans for Head Office cyber risks, building knowledge of common themes and identifying gaps.
• Leading and overseeing DOS activity in response to cyber incidents and rapidly emerging vulnerabilities; working closely with the DOS Security and Resilience Team to reduce seams between physical, personal, technical and cyber security.
• Line management of the DOS cyber security team.
  
  

In this role, you’ll be required to develop a Cyber Security Strategy for the DOS, aligning with Defence’s Cyber Security Strategy and Resilience programme. You’ll lead the work to understand cyber security and resilience risk of the DOS, ensuring the effectiveness of proposed mitigations against an evolving cyber threat.

You’ll promote and advise on best practice and secure by design, ensuring DOS business units are aligned and comply with MOD policy and lead on the implementation of Cyber Compliance Framework activities, driving forward improvements as required. Liaising with key stakeholders, you’ll ensure we are coherent with wider departmental work and objectives and represent the Principal Security Advisor at departmental meetings.

You may also be required to support management of security (cyber) or resilience incidents, including managing crises that disrupt, or have the potential to disrupt, business in Main Building. You’ll need a wider awareness of changing priorities, distinguishing the preferable from the critical and, as a new team, you’ll have an opportunity to shape responsibilities against identified priorities, over the next 5 years.

Sharing the responsibility of providing out of hours advice to Main Building users and stakeholders, you may be required to take part in an on-call rota, with colleagues across the SSBRTA team, for which an allowance is payable.

Responsibilities

• Lead work to understand DOS cyber security and resilience risk, ensuring effectiveness of proposed mitigation against the evolving cyber threat.
• Ensure DOS conducts cyber risk assessments and risk management, providing advice and guidance to senior management, business units and key stakeholders on cyber security and resilience related risks.
• Lead the implementation of the Cyber Compliance Framework and the Cyber Risk Management Framework across DOS, building a cyber risk management community of interest and using it to promote cyber risk knowledge sharing.
• Ensure DOS implements Defence / Government cyber security guidance, policy and tools, overseeing the analysis of mitigation plans for Head Office cyber risks, building knowledge of common themes and identifying gaps.
• Leading and overseeing DOS activity in response to cyber incidents and rapidly emerging vulnerabilities; working closely with the DOS Security and Resilience Team to reduce seams between physical, personal, technical and cyber security.
• Line management of the DOS cyber security team.
  
  

Person specification

Please ensure that your CV and application meet the essential criteria below.

We would expect to see relevant skills and experience in risk management, cyber security strategy and planning, compliance and in leading and managing a team.

You’ll Need:

• Commitment to developing your professional competence.
• The ability to build long term relationships with key internal and external stakeholders.
• Highly effective networking skills and the ability to advise and influence people.
• Experience of leading and managing a team.
• The ability to communicate effectively to a variety of audiences, synthesising information to portray key messages and facilitate effective decision making.
  
  

We are committed to encouraging and enabling our staff to develop in and above their role and we will support you in undertaking further learning and development opportunities, within your designated field and beyond. Wherever possible, we will provide upskilling learning options and further training to support your continuous professional development.

If not held already, opportunity will be provided to gain the following when in post:

• Certificate in Information Security Management Principles (CISMP)
• Certified Information Security Systems Professional (CISSP)
• Certified Cyber Professional (CCP)
• Membership of CIISP, CIISec, BCS or recognised equivalent
  
  

Additional Information

This post is eligible for a Digital Skills Allowance of up to £15,300 per annum. Eligibility for this allowance will be assessed at interview against 4 core technical skills only and reviewed annually in line with MOD policy.

This job role may be suitable for hybrid working, which is an informal, non-contractual and voluntary arrangement, blending a balance of attendance in the workplace (your permanent duty station, which is based on business assessment of where the work is best done) and working from home as a personal choice (if the role is suitable for this). If you are successful, any opportunities for hybrid working will be discussed with you prior to you taking up your post. Whilst embracing hybrid working, there is an expectation you will attend the office at least 3 days a week.

Dependent on the business need, there may be a requirement to travel to meetings within the UK (or potentially occasional overseas visits).

If not already held, successful candidates will be required to undergo DV clearance. Please note this position is open to sole UK Nationals only.

Behaviours

We'll assess you against these behaviours during the selection process:

• Changing and Improving
• Making Effective Decisions
• Leadership
  
  

Technical skills

We'll assess you against these technical skills during the selection process:

• Information risk assessment and risk management
• Applied security capability
• Protective security
• Threat understanding
  
  

Alongside your salary of £59,690, Ministry of Defence contributes £17,292 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides.

Our Benefits Include:

• Learning and development tailored to your role with a dedicated minimum of 5 days per year
• 25 days paid annual leave rising (by 1 day per year) to 30 days upon completion of five years’ service
• Ability to roll up to 10 days annual leave per year
• In addition to eight public holidays per year, you will also receive leave for HM The King’s birthday
• A Civil Service pension
• Parental and Adoption Leave
• Discounts on a range of services within and external to the civil service – Defence Discount Service, Civil Service societies for Sports and Leisure, Healthcare, Insurance, Motoring, Company discounts with Virgin, Vodafone, and Microsoft Office.
• In year rewards and ‘thank you’ schemes such as vouchers and gift cards
• A culture encouraging inclusion and diversity
• Find out more here - Discovermybenefits
• The post does not offer relocation expenses (move of home, excess fares or temporary transfer). Non Standard move applicants will be eligible for the full package, subject to eligibility.
• Please Note: Expenses incurred for travel to interviews will not be reimbursed.
• Please be advised that the Department is conducting a review of all pay related allowances which could impact on those allowances that the post currently being advertised attracts.
  
  

Equality and Diversity

Our people are at the heart of everything we do at Defence Digital. It’s vital that our workforce reflects the diversity of both our audience and the wider society in the UK, so we’re proud to be an equal opportunities employer and we actively seek candidates from diverse backgrounds and communities. We also recognise the importance of a good work life balance, so we do everything we can to accommodate flexible working, including part-time and job shares for all our roles. Please just let us know in your application or at any stage throughout the process if this is something you want to explore.

Defence Digital operates an organisation model in which every individual belongs to a Government Profession. The successful applicant will be posted into one of the defined Government Professions on Standard Terms of Reference for the grade. Defence Digital reserves the right to move individuals between roles, within their allocated profession, to meet the needs of the business and in support of agile resourcing.

Any move to MOD from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax-Free Childcare. Determine your eligibility at https://www.childcarechoices.gov.uk/.

The Ministry of Defence is committed to providing a safe and healthy working environment for its staff which includes educating them on the benefits of not smoking, protecting them from the harmful effects of second-hand smoke and supporting those who want to give up smoking. Under the Smoke-Free Working Environment policy, Smoking and the use of all tobacco products (including combustible and chewing tobacco products) will not be permitted anywhere in the Defence working environment however some exemptions are in place, please refer to local guidance. The policy is Whole Force and includes all Defence personnel, contractors, visitors and other non-MOD personnel. All applicants seeking, considering, or accepting employment with the Ministry of Defence should be aware of this policy and that it is already in place at a number of Defence Establishments.

MOD Recruitment Satisfaction Survey – We may contact you regarding your experience to help us improve our customer satisfaction. The survey is voluntary and anonymous. You may however be given the opportunity to provide additional information to help us improve our service which includes the collection of some personal data as defined by the United Kingdom General Data Protection Regulation (UK GDPR). The MOD Privacy Policy Notice sets out how we will use your personal data and your rights.

Strategic Command is going through a significant transformation programme which aims to improve the way the Command conducts its business and delivers for Defence and the nation. As a consequence of this, all posts within Strategic Command Headquarters and in time the wider organisation, are/will be subject to review and potential changes as we continuously improve across the period of the transformation programme. These changes may be minor or could be more substantive and will generate new opportunities. Throughout, the Command’s transformation programme is committed to following the MOD’s framework on managing and supporting people through the change process and places an emphasis on early and open consultation and engagement with the Command’s personnel and Trade Unions.

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

Application

To apply please complete the CV template provided on the CS Jobs dashboard, ensuring it highlights your relevance to the essential criteria listed in the person specification.

It is essential that all applicants provide a personal statement (max. 1250 words), assessed against your responses to the questions listed below.

Each One Will Be Scored 1-7 And Make Up Part Of Your Overall Score To Assess Your Suitability To Be Invited To Interview:

• Describe your experience of developing a cyber security strategy and/or resilience programme, within an organisation.
• Describe your experience of providing advice and guidance on cyber security related risks, within an organisation.
• Tell us about your ability to create, build and maintain strong working relationships with both internal and external stakeholders.
  
  

At sift, you will be assessed against your CV and Personal statement.

At Interview, You Will Be Assessed Against:

We’ll assess you against these Behaviours, technical skills & experience during the interview process:

Behaviours

• Changing and Improving
• Making Effective Decisions
• Leadership
  
  

Technical Skills

• Applied security capability
• Information risk assessment and risk management
• Protective security
• Threat understanding
  
  

The Government Security Profession Career Framework and the Cyber Security – Risk Manager Principal role used in this vacancy can be found at: Government Security Profession career framework.

The Civil Service embraces diversity and promotes equality of opportunity. There is a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

If you need to advise us that you need additional help or reasonable adjustments for the recruitment process, please contact: [e-mail] .

As a result of the changes to the UK immigration rules which came in to effect on 1 January 2021, the Ministry of Defence will only offer sponsorship for a skilled worker visa under the points based system, where a role has been deemed to be business critical. This role does not meet that category and we will not sponsor a visa. It is therefore NOT open to applications from those who will require sponsorship under the points based system.

Should you apply for this role and be found to require sponsorship, your application will be rejected and any provisional offer of employment withdrawn.

Feedback will only be provided if you attend an interview or assessment.

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

Security

Successful candidates must undergo a criminal record check.

Successful candidates must meet the security requirements before they can be appointed. The level of security needed is developed vetting (opens in a new window).See our vetting charter (opens in a new window).

People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Successful candidates must undergo a criminal record check.

Successful candidates must meet the security requirements before they can be appointed. The level of security needed is developed vetting (opens in a new window).See our vetting charter (opens in a new window).

People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

Open to UK nationals only.

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).

The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).

The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.

Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job Contact :

• Name : Defence Digital Talent Acquisition Team
• Email : [e-mail]
  
  

Recruitment team

• Email : [e-mail]
  
  

Further information

Please ensure you read the attached candidate information document prior to completing your application. If you are dissatisfied with the service you have received from DBS, or believe that DBS has failed to follow the recruitment process in line with the Civil Service Commission principles of selection for appointment on merit on the basis of Fair and Open competition, you can raise a formal complaint by writing to DBS at the following address: Defence Business Services, Scanning Hub, Room 6124, Tomlinson House, Norcross Lane, Blackpool, FY5 3WP. If after raising your complaint with DBS you remain dissatisfied you can complain directly to the Civil Service Commission at the following address: , Civil Service commission, Room G/8, 1 Horse Guards Road, London, SW1A 2HQ Or by email: [e-mail]