Principal Cyber Security Adviser

NHS ENGLAND; City of Westminster; Hybrid; GBP 55,000 - 75,000; Full time

Job summary

A national health service organization in the UK is seeking a Principal Cyber Security Adviser to lead the cyber risk assessment capability. This role requires strong expertise in cyber security risk management and the ability to communicate complex cyber security topics effectively. The successful candidate will develop strategies to manage system cyber risks and ensure compliance with national standards. This position promises a flexible approach to working arrangements and additional benefits for managing critical cybersecurity challenges.

Benefits

Additional payments for Recruitment and Retention Premia

Flexible working arrangements

Commitment to professional development

Qualifications

• Experience managing cyber security risks in complex environments.
• Expertise in conducting risk assessments and developing recommendations.
• Ability to communicate cyber security topics to diverse stakeholders.

Responsibilities

• Lead cyber risk assessment capability across the Joint Cyber Unit.
• Provide expert advice on cyber security issues to staff and partners.
• Develop and oversee systems for assessing and managing cyber risk.

Skills

Cyber security risk management

Risk analysis

Stakeholder communication

Technical expertise in cyber security

Education

Relevant cyber security qualifications

ISACA: Certified Information Security Manager (CISM)

Job description

The NHS is building a culture that is positive, compassionate and inclusive - and we all have our part to play.

As employers we are committed to protecting and promoting the physical and mental health and wellbeing of all our colleagues. This underpins our values as set out in the NHS Constitution and supports us to be an Employer of Choice, while helping our colleagues to deliver high quality services for our patients and communities.

As a flexible employer, we want to support you to work in a way that is best for the NHS, our patients and you. Talk to us about how we might be able to accommodate a flexible working arrangement whether that's a job share, part time, hybrid working or another flexible pattern. In addition, although the role advertised may have a 'home' office base indicated, we remain committed to supporting flexibility around workplace locations. If it works for the service, we will do our best to make it work for you.

We are an accredited Living Wage Employer which means that every colleague working for our organisation and third-party contractors will earn a real Living Wage. We are one of over 15,000 organisations, who voluntarily chose to pay the real Living Wage.

This role sits within the Joint Cyber Unit (JCU) a collaboration between the Department of Health and Social Care (DHSC) and NHS England (NHSE). The JCU is embedded within the Digital Policy Unit (DPU), a unit comprising both DHSC staff and NHSE staff intended to design, plan and build a digitally enabled, data driven and safe health and social care system with ministers and the NHS.

The purpose of the JCU is to provide strategic leadership in cyber security across the health and care sector, assure the cyber security of the sector, act as system stewards to improve cyber resilience across the health and care system and to provide advice which empowers health and care staff to share information appropriately and securely to deliver care.

The JCU sets, develops, and implements strategy, policy and standards for cyber security across the NHS and Adult Social Care in England. It has responsibility for designing, implementing and the ongoing assurance of the cyber security system risk management and compliance framework in place across the wider health and care system.

The JCU is comprised of two divisions:

• Governance, Risk and Compliance - cyber and information governance, system engagement, system compliance, system supply chain, system risk management and internal JCU business operations.
• Strategy and Policy - development and implementation of national strategy, policy and regulation, The Principal Cyber Security Adviser post sits within the Governance, Risk and Compliance division in the System Cyber Risk and Assurance function which is responsible for managing cyber risk across the health and care system, ensuring that we operate within the appetite set by both the NHSE and DHSC board.

As a Principal Cyber Security Adviser assigned to lead the cyber risk assessment capability, the post holder will work as part of a dynamic team in delivering an effective service supporting managers and staff across the Joint Cyber Unit to:

• Provide expert level subject matter knowledge in the cyber security area from both a technical and a business perspective to advise on issues across the cyber security domain and all activity across the Joint Cyber Unit.
• Establish and oversee process for assessing cyber risk and advising proportionate national interventions, including funding and regulatory levers, across the system.
• Lead the development of risk assessments into flagged scenarios and make recommendations as to how risk is best managed, articulating recommendation verbally and in writing, potentially to senior audiences.
• Lead on the reporting to the National Chief Information Security Officer on system cyber risk through development and oversight of a system cyber risk scenario library, drawing on support from the cyber risk intelligence and cyber governance teams.

The post holder will provide efficient, effective and high quality, professional and well-co‑ordinated cyber security leadership meeting all statutory, regulatory and NHS requirements ensuring alignment with the activity of the organisation.

The postholder will have strong risk management and risk analysis skills and an expert grasp of the cyber components.

The post holder will be responsible for:

• Establishing and leading a capability to assess system cyber risk and recommend proportionate national interventions (e.g. regulatory action, funding decisions, and technical support) to manage it.
• Personally, delivering risk assessments, potentially to extremely tight timescales and with limited information, including recommendations on how to proportionately manage the risk.
• Contribute to Cyber Improvement programme where relevant to areas of responsibility.
• Build relationships across Joint Cyber Unit, NHSE, and NHS more broadly to both facilitate own understanding of system cyber risk and embed a rational risk basis into all of the unit's activity.
• Work closely with the cyber risk intelligence team to understand the state of system cyber risk and appropriately feed this into risk assessments.

Please be aware there are residency requirements you need to meet.

The post of Principal Cyber Security Adviser has been awarded a Recruitment and Retention Premia (RRP) in response to current labour market conditions. In recognition of this, the role attracts an additional monthly RRP payment equal to 30% per annum. Please be aware that RRP is non‑contractual and subject to review.

All roles in the Technology, Digital & Data Directorate require a Basic DBS check.

You can find further details about the role, including key responsibilities and accountabilities, alongside the organisational structure and person specification in the attached Job Description and other supporting documents.

Colleagues with a contractual office base are expected to spend, on average, at least 40% of their time working in‑person.

Secondments

Applicants from within the NHS will be offered on a secondment basis only, agreement should be obtained from their employer prior to submitting the application.

Our commitments to you

We are passionate about creating an inclusive workplace that promotes and values diversity. We know that different ideas, perspectives and backgrounds create a stronger and more creative work environment that delivers better patient outcomes. We strive to ensure our people feel trusted, valued and empowered. We're passionate about nurturing and developing people. When you join us, we want you to grow and excel, and we offer many opportunities for you to do that. We welcome your talent and enthusiasm irrespective of age, disability, neuro‑divergence, sex, gender identity and gender expression, race or ethnicity, religion or belief, sexual orientation, or other personal circumstances. We have policies and procedures to ensure that all applicants are treated fairly and consistently at every stage of the recruitment process, including the consideration of reasonable adjustments for people who have a disability and/or who are neuro‑divergent.

We welcome applications from disabled candidates. If you meet all the essential criteria, you will be guaranteed an interview.

Your application is your opportunity to demonstrate to us how you meet the requirements of the role. Whilst we appreciate that you may have had support with your application (e.g., using AI technology or guidance from a trusted individual), it's important that the information contained within your application reflects your own knowledge, skill, and experience and we trust that you apply on that basis.

If applying for this role on a secondment basis, please make sure you have obtained prior agreement from your current line manager to apply for this position.

Please note that we currently do not accept applications via recruitment agencies.

To comply with the HM Government Functional Standard GovS 007, and specifically the Personnel Security Standards 2024, individuals employed or contracted by NHS England may be required to undergo a Baseline Personnel Security Standards check, dependent on the role.

The NHS Business Services Authority is responsible for the processing of your application; a privacy notice is attached to advise you on how we will process your personal data.

If you have applied via NHS Jobs, your submitted application will be imported into our preferred third‑party recruitment system. All subsequent information regarding your application will be generated from apps.trac.jobs. If you are appointed to a post, information will also be transferred into the NHS Electronic Staff Records system.

The post holder should have expertise in managing cyber security risks in large and complex environments and should be able to evidence their commitment to continuing professional development.

This is a lead role within the risk and assurance function, as such the post holder will need to have line management experience and the ability to deal with competing priorities and tight deadlines.

They should also have the ability to build and maintain strong working relationships with other teams and be able to communicate cyber security risk topics to a range of stakeholders (both technical and non‑technical).

• Subject matter expertise across a number of key areas relating to cyber security.
• Strong risk management and risk analysis skills and an expert grasp of the cyber components.
• Evidence of post qualifying and continuing professional development.
• Should have an appreciation of the relationship between the Department of Health, NHS England and individual provider and commissioning organisations.
• Experience of delivering against competing priorities and deadlines while also directing the work of teams/individuals.
• A willingness to train to gain appropriate cyber qualifications (ISACA: Certified Information Security Manager (CISM)).
• All NHS England Cyber Security personnel must hold security clearance SC level as a minimum. To meet National Security Vetting requirements, you must have resided in the UK for a minimum of 3 out of the past 5 years for SC clearance. Candidates who were posted abroad for service with HM Government, Armed Forces or within a UK government role will still be considered.

Our work supports the NHS to deliver high quality services for patients and best value for taxpayers.

Our staff bring expertise across hundreds of specialisms - including clinical, operational, commissioning, technology, data science, cyber security, software engineering, education, and commercial - enabling us to design and deliver high‑quality NHS services.

We lead the NHS in England by:

• Enabling local systems and providers to improve the health of their people and patients and reduce health inequalities
• Making the NHS a great place to work, where our people can make a difference and achieve their potential
• Working collaboratively to ensure our healthcare workforce has the right knowledge, skills, values and behaviours to deliver accessible, compassionate care
• Optimising the use of digital technology, research, and innovation
• Delivering value for money

Earlier this year, the Government announced that NHS England will gradually merge with the Department of Health and Social Care, leading to full integration. The aim is to create a smaller, more strategic centre that reduces duplication and eliminates waste.

If successful at interview, we will initiate an Inter Authority Transfer (IAT) via the Electronic Staff Record (ESR). This retrieves key data from your current or previous NHS employer to support onboarding, including competency status, Continuous Service Dates (CSD), and annual leave entitlement. You may opt out at any stage of the recruitment process.

NHS England