Senior Cyber Security & Risk Governance Lead

Scottish Government; Glasgow; Hybrid; GBP 70,000 - 90,000; Full time

Benefits offered by this job

Hybrid working

Disability Confident Employer

GDD pay supplement

Flexible working options

Job summary

Social Security Scotland is seeking a Senior Information and Cyber Security Officer to strengthen governance, risk management, and compliance across the organisation. You will work with the Cyber Security Risk and Assurance Manager to mature the ISMS and assurance activities, guiding risk-based decisions.

The role requires deep expertise in information security standards, regulatory requirements, and stakeholder engagement to deliver auditable security outcomes and resilient controls.

Qualifications

• In-depth knowledge of information security standards like ISO/IEC 27001 and NIST SP 800-53, with understanding of GDPR and DPA 2018 requirements.
• Proficiency in identifying, assessing, and mitigating information security risks and implementing controls.

Responsibilities

• Independently undertake risk management activities within security governance.
• Lead security risk assessments, threat assessments, and ensure compliance with regulations.
• Provide tailored security advice to stakeholders to remediate identified risks.
• Provide expert security guidance to enable auditable decisions by risk or service owners.
• Lead security governance groups to promote strong practices and maintain the organisation's cyber posture.
• Support ISMS development and third-party assurance activities.
• Contribute to awareness initiatives and incident response to contain threats.

Skills

ISO 27001

NIST SP 800-53

GDPR & DPA 2018

ISMS

Risk management

Security governance

Threat assessment

Stakeholder engagement

Job description

Social Security Scotland is seeking a Senior Information and Cyber Security Officer to strengthen governance, risk management, and compliance across the organisation. You will work with the Cyber Security Risk and Assurance Manager to mature the ISMS and assurance activities, guiding risk-based decisions.

The role requires deep expertise in information security standards, regulatory requirements, and stakeholder engagement to deliver auditable security outcomes and resilient controls.