Cyber Technology Risk Lead (Effectiveness & Engagement) - Government Digital Service - G7

Location

Bristol, London, Manchester

About the job

Job summary

As the Government Cyber Unit, our mission is to protect public services and the wider Government from cyber threats by setting strategic direction, managing programmes that implement the strategy across central government, establishing standards and policies, supporting secure digital service delivery, assuring cyber security, and leading operational response to threats, vulnerabilities and incidents.  

The risks facing government and the public sector mirror the scale and complexity of government. Some risks exist in aggregate across government and need active management to stop them impacting multiple areas or becoming a national security issue. 

This role is pivotal in defining and implementing a cross-government approach to address these challenges, strengthening our ability to manage and respond to complex technology risks across our organisation and government. 

We’re part of the Department for Science, Innovation and Technology (DSIT) and employ more than 1,000 people all over the UK, with hubs in Manchester, London and Bristol. 

You will be joining the Technology Risk team, part of the Cyber Accountability Deputy Director area, helping to drive consistent, effective technology risk management across government. The Technology Risk team works across central teams and departments to improve how technology risks are identified, understood and acted on using frameworks, data and targeted engagement to drive accountability and investment. 

Join us for rewarding work that makes a difference across the UK. You’ll solve some of the nation’s highest-priority digital challenges, helping millions of people access services they need. 

Job description

Former DSIT recruitment campaigns are continuing as usual, but candidates should be aware that following the Government’s announcement on the changes to some civil service departments, roles will be subject to the machinery of government moves and will ultimately be in one of the new departments. We will provide more information if you are selected for a role. This work remains of high importance to the civil service, and we thank you for your continued interest. 

As a Cyber Technology Risk Lead (Effectiveness & Engagement) you’ll: 

• Departmental Capability Building: design and run a structured, repeatable engagement programme with departments, targeted where the risk and the need are greatest, building the trust needed for departments to tell us what is really happening
• Testing Effectiveness: form and evidence a view on whether technology risk controls across government are working, and whether the central picture of risk reflects reality in departments. Report honestly where the framework, the risk appetite or the reported position does not hold up
• Framework & Appetite in Practice: drive practical adoption of the Technology Risk Framework and risk appetite, helping departments apply them proportionately in their own environments and embed them in local decisions and investment
• Controls & Remediation: support departments to identify proportionate controls, risk treatments and remediation, and to prioritise action on the basis of risk, working alongside the emerging control library and GovAssure activity
• Challenging the Model: use what you see on the ground to test the risk universe, severity judgements and hazard assumptions, feeding practical evidence back to the Systemic Risk Lead and the Governance & Reporting Lead, and improving the quality of departmental inputs into the central aggregation model
• Thematic Guidance: create and share accessible guidance and peer learning on priority themes such as legacy IT, digital resilience, supply chain, post quantum cryptography and AI adoption, pitched at different levels of maturity and complementing, not duplicating, NCSC and other cross government guidance
• Cross-Government Coordination: work with GCU Partnering, NCSC, the Assurance team and wider resilience partners so technology risk is embedded in departmental decision making and portfolio planning, using assurance outputs rather than running a parallel assurance regime

Person specification

We’re interested in people who have: 

• experience gathering evidence and forming an independent, defensible judgement on how well risks and controls are being managed in organisations you do not directly control 
• experience designing proportionate evidence and reporting approaches that get a credible picture without overburdening the organisations providing it, using data and insights from a range of relevant sources to monitor maturity and control effectiveness over time
• strong understanding of organisational risk appetite, risk assessment and risk treatment, including proportionate controls and remediation, and the ability to interpret risk in relation to corporate governance, strategic direction and planning 
• confident influencing, advising and building consensus with senior stakeholders, including boards and executive teams as well as the ability to communicate uncomfortable findings clearly while maintaining the working relationship
• experience building risk, security or technology capability across organisational boundaries, designing and delivering engagement or improvement programmes that champion protective security and change how others manage risk in practice 
• experience translating frameworks, policy or guidance into practical, usable products tailored to different levels of maturity 
• understanding of digital service delivery challenges including legacy systems, resilience and technical debt, how security measures might impact on users or business needs, and of emerging risks such as supply chain vulnerabilities, post quantum cryptography and AI adoption
• understanding of the current threat landscape and the ability to communicate tailored, threat informed risk information to a range of audiences