Office for National Statistics
Cyber Security Risk Manager Lead
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Locations for this role are Newport and Titchfield (Fareham),
This role is aligned to ONS hybrid working principles, which are based on attending the office with purpose. The post holder will be expected to contribute to the organisation’s overall 40% office attendance, in line with business and role requirements.
The induction process for the role will be conducted in person.
Job Summary
The Office for National Statistics (ONS) is the UK’s largest producer of official statistics, covering a range of key economic, social and demographic topics. These include measuring changes in the value of the UK economy, estimating the size, geographic distribution and characteristics of the population, and providing indicators of price inflation, employment, earnings, crime and migration.
The last few years has seen an extensive overhaul of security and information management to meet the challenges of corporate and statistics transformation in technology, methods and practice, the Digital Economy Act and organisational risk appetite. The capability is evolving and expanding to address changes in threat and business direction. Security and Information Management Directorate (SaIM) operates five key services across ONS: security risk advice and management; knowledge and information management (KIM); physical security and business continuity; security compliance and audit; security operations including our Security Operations Centre.
Job Description
The Cyber Security Risk Manager - Lead roles forms part of the Security Risk Advisory team within the Security and Information Management Division at the Office for National Statistics (ONS). The role reports to the Cyber Security Risk Manager - Principal. The primary focus of these roles are to provide the Organisation with security advice and best practice to develop ‘Secure by Design’ protections for organisational assets and embed the ONS Security Framework - principles; policies; processes; threat model; security risk management into the ONS.
These roles will be dedicated to supporting all security assessment and assurance activities associated with the preparation and delivery of UKSA digital programmes, such as Census 2031. Key activities will involve security assessment, assurance, threat modeling and mitigation advice/guidance for all aspects of digital delivery, including in-house and procured/third-party elements. Key outcomes from the roles are the identification of security risk within the business context, the identification of appropriate mitigation approaches for business selection and the management of these options through to implementation within the live service. The security advice provided will be informed by threat, vulnerability and risk analysis for business and third parties. The focus, outcomes and responsibilities are aligned to the Government Security Profession framework of the Cyber Security Risk Manager – Lead.
Responsibilities
- Supporting the development of business-focused security solutions for digital products and business operations that cover data collection, storage and processing of Official - Sensitive information (deployed both internally and via external suppliers);
- Identifying security threat and risk to the Organisation's digital products, data assets and business operations as part of the delivery lifecycle;
- Lead the analysis and derivation of business-supporting security needs, undertake Cyber Security related risk assessments, conduct tailored threat assessment and other risk management activities, and ensure activities are consistent with applicable regulations and legislation;
- Independently undertake risk management activities within a given area of practice or expertise, usually within established security and risk management governance structures;
- Lead the analysis and derivation of business-supporting security needs, undertake Cyber Security related risk assessments, conduct tailored threat assessment and other risk management activities, and ensure activities are consistent with applicable regulations and legislation;
- Consulting with the Organisation’s security stakeholders to ensure that the solutions deployed are secure and fit for purpose;
- Liaising with the Organisation’s business, technology and security colleagues to ensure various business needs are understood and applied, including providing general security architecture, guidance and advice to the stakeholders;
- Advising on opportunities for using secure and open-source products and any implications of such an approach.
- Ensure that security policies and security controls remain appropriate and proportionate to the assessed risks, and are responsive and adaptable to the changing threat environment, business requirements and ONS policies;
- Provide tailored advice to a range of stakeholders on how to remedy identified risks by proportionately applying security capabilities, using published guidance, standards, and drawing on a range of experts as well as personal expertise;
- Provide expert security advice that highlights Cyber Security related risks, so risk or service owners can make well-informed and auditable decisions.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Person Specification
Essential Criteria:
- Extensive expertise in cloud, application, infrastructure and networking security controls, with strong proficiency across cyber, physical, procedural and technical (ICT) security domains, particularly in relation to secure data management.
- Proven experience delivering high quality security advice and technical security solutions within a UK Government Department, supporting complex operational and digital environments.
- Strong working knowledge of UK Government security frameworks and standards, including the Government Security Policy Framework (SPF), ISO 27001, and the Data Protection Act (DPA).
- Commitment to professional development, ideally working towards relevant certifications such as CESG Certified Professional (CCP) at Senior Practitioner level and/or membership of professional bodies such as the British Computer Society (BCS).
- A successful track record of leading and influencing the implementation of security frameworks (e.g., Secure-by-Design) in multi-disciplinary environments.
Behaviours
- Seeing the Big Picture
- Leadership
- Communicating and Influencing
Technical skills
- Applied Security Capability - Practitioner
- Information Risk Assessment and Risk Management - Practitioner
- Protective Security - Practitioner
- Threat Understanding - Practitioner
Salary
Alongside your salary of £60,007, Office for National Statistics contributes £17,384 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides.
The Office for National Statistics is part of the Civil Service, and as such we share a number of key benefits with other departments, whilst also having our own unique offerings to support our valued colleagues across the organisation.
Inclusion & Accessibility
At ONS we are always looking to attract the very best people from the widest possible talent pool, and we are proud to be an inclusive, equal opportunities employer. As a Disability Confident Leader we’re committed to ensuring that all candidates are treated fairly throughout the recruitment process.
As part of our application process, you will be prompted to provide details of any reasonable adjustments to our recruitment process that you need. If you would like to discuss any reasonable adjustments before applying, please contact the recruitment team in the first instance.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
If you would like an accessible version of any of the attachments or recruitment documents below or linked to in this advert, please contact the recruitment team who will be happy to assist.
ONS are committed to flexible ways of working that support a healthy work-life balance. ONS has already considered how this job could be right sized for applicants working flexibly and we are happy to explore options with you about working part time, in a job share or flexibly, in line with our hybrid working policies.
Artificial intelligence
Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance for more information on appropriate and inappropriate use.
Selection process details
This vacancy is using Success Profiles, and will assess your Behaviours, Experience and Technical skills.
Security Clearance
For ONS the requirement for SC clearance is to have been present in the UK for 3 consecutive years immediately prior to applying and the department will consider eligibility by exception on a case-by-case basis. You will be asked to provide information regarding your UK residency during your application, and failure to provide this will result in your application being rejected.
If you are unsure that you meet the eligibility above, please read the information available on Gov.uk on this link or contact the recruitment email on the advert before applying to discuss, as failure to meet the residency requirements will result in your security clearance application being rejected and any offer of employment being withdrawn.
At the point of SC application, you will need to provide or give access to the following evidence:
- Departmental or company records (personnel files, staff reports, sick leave reports and security records)
- UK criminal records covering both spent and unspent criminal records
- Your credit and financial history with a credit reference agency
- Security Services records
Please note we will reach out to you once the advert has closed to confirm eligibility for this role, this will be via an e-mail. Please check your junk e-mails for any correspondence.
Visa Sponsorship
ONS may be able to provide visa sponsorship where the role meets ONS sponsorship criteria and all relevant Home Office requirements. Applicants must hold, or be eligible to obtain, the right to work in the UK before employment commences.
Application Process
Number of Stages: 2 stage process
Stage 1: Application
Stage 2: Interview
Stage 1 – Application
The assessment process at the application stage will be based on your work history, CV, skills, experience, and personal statement. It is important that your application is tailored to highlight the skills, knowledge, and experience relevant to the role.
A personal statement is required at application stage, the maximum word count allowed is 1000 words, which should not be exceeded. You should provide evidence for each essential skill criterion listed in the person specification. As these criteria are scored, it is advisable to give clear examples for each one, including the impact of your actions, ideally utilising the STAR technique (Situation, Task, Action, Result).
Please note that Success Profiles Behaviour examples are not required at this stage of the application
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location