Government Digital Service
Cyber Technology Risk Lead (Effectiveness & Engagement)
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Job Description
Location
This role is available across our London, Bristol and Manchester locations
About the Role
As the Government Cyber Unit, our mission is to protect public services and the wider Government from cyber threats by setting strategic direction, managing programmes that implement the strategy across central government, establishing standards and policies, supporting secure digital service delivery, assuring cyber security, and leading operational response to threats, vulnerabilities and incidents.
The risks facing government and the public sector mirror the scale and complexity of government. Some risks exist in aggregate across government and need active management to stop them impacting multiple areas or becoming a national security issue. This role is pivotal in defining and implementing a cross-government approach to address these challenges, strengthening our ability to manage and respond to complex technology risks across our organisation and government.
We’re part of the Department for Science, Innovation and Technology (DSIT) and employ more than 1,000 people all over the UK, with hubs in Manchester, London and Bristol. You will be joining the Technology Risk team, part of the Cyber Accountability Deputy Director area, helping to drive consistent, effective technology risk management across government. The Technology Risk team works across central teams and departments to improve how technology risks are identified, understood and acted on using frameworks, data and targeted engagement to drive accountability and investment.
Join us for rewarding work that makes a difference across the UK. You’ll solve some of the nation’s highest-priority digital challenges, helping millions of people access services they need.
Job Description
As a Cyber Technology Risk Lead (Effectiveness & Engagement) you’ll:
- Departmental Capability Building: design and run a structured, repeatable engagement programme with departments, targeted where the risk and the need are greatest, building the trust needed for departments to tell us what is really happening
- Testing Effectiveness: form and evidence a view on whether technology risk controls across government are working, and whether the central picture of risk reflects reality in departments. Report honestly where the framework, the risk appetite or the reported position does not hold up
- Framework & Appetite in Practice: drive practical adoption of the Technology Risk Framework and risk appetite, helping departments apply them proportionately in their own environments and embed them in local decisions and investment
- Controls & Remediation: support departments to identify proportionate controls, risk treatments and remediation, and to prioritise action on the basis of risk, working alongside the emerging control library and GovAssure activity
- Challenging the Model: use what you see on the ground to test the risk universe, severity judgements and hazard assumptions, feeding practical evidence back to the Systemic Risk Lead and the Governance & Reporting Lead, and improving the quality of departmental inputs into the central aggregation model
- Thematic Guidance: create and share accessible guidance and peer learning on priority themes such as legacy IT, digital resilience, supply chain, post quantum cryptography and AI adoption, pitched at different levels of maturity and complementing, not duplicating, NCSC and other cross government guidance
- Cross-Government Coordination: work with GCU Partnering, NCSC, the Assurance team and wider resilience partners so technology risk is embedded in departmental decision making and portfolio planning, using assurance outputs rather than running a parallel assurance regime
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Person Specification
We’re interested in people who have:
- experience gathering evidence and forming an independent, defensible judgement on how well risks and controls are being managed in organisations you do not directly control
- experience designing proportionate evidence and reporting approaches that get a credible picture without overburdening the organisations providing it, using data and insights from a range of relevant sources to monitor maturity and control effectiveness over time
- strong understanding of organisational risk appetite, risk assessment and risk treatment, including proportionate controls and remediation, and the ability to interpret risk in relation to corporate governance, strategic direction and planning
- confident influencing, advising and building consensus with senior stakeholders, including boards and executive teams as well as the ability to communicate uncomfortable findings clearly while maintaining the working relationship
- experience building risk, security or technology capability across organisational boundaries, designing and delivering engagement or improvement programmes that champion protective security and change how others manage risk in practice
- experience translating frameworks, policy or guidance into practical, usable products tailored to different levels of maturity
- understanding of digital service delivery challenges including legacy systems, resilience and technical debt, how security measures might impact on users or business needs, and of emerging risks such as supply chain vulnerabilities, post quantum cryptography and AI adoption
- understanding of the current threat landscape and the ability to communicate tailored, threat informed risk information to a range of audiences
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Important Notes
Please note -
This role requires SC clearance, which would normally need 5 years’ UK residency in the past 5 years. This is not an absolute requirement, but supplementary checks may be needed where individuals have not lived in the UK for that period. This may mean your security clearance (and therefore your appointment) will take longer or, in some cases, not be possible.
Sponsorship
DSIT cannot offer Visa sponsorship to candidates through this campaign. DSIT holds a Visa sponsorship licence but this can only be used for certain roles and this campaign does not qualify.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location