PU-17/0189 Security Engineer for Survey Data Collection Platform

Tender description

Who Speclialist Work With The successful candidate will work closely with several multi-disciplinary product development teams to provide guidance and consultation on the outcomes from testing, and share processes, solutions and practices that support secure coding and architecture. A strong technical background is therefore essential, with practical experience of working on solutions (e.g. in software development or system/network/infrastructure architecture and administration). Teams generally consist of a Delivery Manger, Technical Lead, Product Owner and Software Engineers and User Research/Designers. Along with this role's "home" team they will work closely with ONS Information Assurance, evidencing and reassuring that the security patterns of products are to standard What Specialists Work On • Applying security vulnerability and penetration testing on digital products, using manual/automated tools and processes, including static analysis. • Integrating security testing into continuous integration/deployment pipelines. • Promoting secure coding/architecture practices (such as OWASP) & best practice around monitoring and alerting across teams - collaborate to ensure security is built in at all stages • Advising teams on appropriate cryptographic algorithms and formats for data exchange, storage • Communicating new and emerging threats to teams. • Articulating risks/associated threats and how best to mitigate them. • Work with ONS Information Assurance providing evidence to aid their assurance of products Where the Work Takes Place Office for National Statistics Government Buildings Cardiff Road Newport South Wales Early Market Engagement Working Arrangements Teams are co-located and work in close harmony with daily Agile ceremonies and regular show and tell/stakeholder engagement activities. Consequently, preferred working arrangements are onsite 5 days per week @ ONS Newport office Any amendment to this will be done on a local basis and is likely to be on an infrequent basis. Work Location Office for National Statistics Government Buildings Cardiff Road Newport South Wales Security Clearance Must have Disclosure Scotland SC Clearance is desirable but not essential Additional T&Cs Skills & Experience • Direct experience executing vulnerability and penetration testing, (manual processes automated tools), ideally into a continuous integration/delivery pipeline. Detailed technical knowledge of vulnerabilities, threats, attack methods, and infection vectors. • Experience working with highly scalable, secure and available systems handling sensitive data, preferably in the Cloud. • Experience working closely with development teams to ensure secure coding and architecture is a fundamental part of product development. With detailed knowledge of OWASP and other best practices. • Knowledge of cryptographic algorithms, including encryption, authentication and hashing and experience of applying them in different situations. Be proficient at holding effective,ongoing technical discussion and input with development teams. Nice to Haves • Experience investigating suspected attacks and managing security incidents. • Understanding of Government security standards and Information Assurance processes. • Crest or CHECK certifications (team leader or team member) • Certified Ethical Hacker (CEH) • CISSP or similar familiarity with security architecture Experience in Physical Security • Social Engineering Static program analysis Linux, Python, Java Amazon AWS / Cloud environments • Fuzz testing/fuzzing. No. of Specialists to Evaluate 3 Cultural Fit Criteria Have experience of working in an Agile delivery environment Share knowledge and experience with other team members Be comfortable standing up for their discipline Work as a team with our organisation and other suppliers Be transparent and collaborative when making decisions Assessment Method Evaluation Weighting Technical competence 70% Cultural fit 10% Price 20% Questions from Suppliers Budget range budget agreed, suppliers to provide candidates at market rate for skill set