Senior Information and Cyber Security Officer

The Scottish Government; Glasgow; On-site; GBP 70,000 - 90,000; Full time

Job summary

Social Security Scotland is seeking a Senior Information and Cyber Security Officer to join the Digital Risk and Security branch. You will help drive the Security Risk and Assurance programme and strengthen governance, risk management, and compliance frameworks.

You will partner with the Cyber Security Risk and Assurance Manager to develop ISMS, apply ISO 27001, GDPR, and NIST 800-53, and provide clear, auditable security guidance across the organisation.

Qualifications

• Deep expertise in governance, risk management, and assurance using recognised standards and frameworks.
• Ability to identify, analyse and mitigate cyber risks with auditable decision-making.
• Lead policy, compliance and third‑party assurance activities; drive maturity of security frameworks.

Responsibilities

• Drive the Security Risk and Assurance programme.
• Strengthen governance, risk management, and compliance frameworks across the organisation.
• Engage stakeholders and influence security policy and third‑party assurance activities.
• Support incident response to contain and resolve threats.
• Contribute to security projects and raise security awareness across the organisation.

Skills

Governance

Risk management

ISMS

Stakeholder engagement

Security assurance

Incident response

Compliance

ISO 27001

NIST 800-53

GDPR

Job description

Are you ready to make a real impact in cyber security?We’relooking for an experienced Senior Information and Cyber Security Officer to join our Digital Risk and Security branch at Social Security Scotland. In this key role,you’llhelp drive our Security Risk and Assurance programme and strengthen our governance, risk management, and compliance frameworks.

You’llwork at the heart of our security function - partnering with the Cyber Security Risk and Assurance Manager and contributing to the ongoing development of our governance, risk, and compliance capabilities across the organisation.

The ideal candidate can:

• Apply deepexpertisein governance, risk management, and assurance, using ISO 27001, NIST 800-53, GDPR, and DPA 2018 to strengthen organisational security.
• Identify, analyse, and mitigate cyber risks, giving stakeholders clear, actionable advice that enables well‑informed, auditable decisions.
• Engage and influence stakeholders, lead policy, compliance, and third‑party assurance activities, and drive the maturity of security frameworks and the ISMS.
• Contribute to security projects, build security awareness across the organisation, and support incident response tocontainand resolve threats.