PU-17/0189 Security Engineer for Survey Data Collection Platform

Tender description

Summary of the work ONS is seeking an experienced Security Engineer and ethical hacker to undertake vulnerability and penetration-testing (ideally integrated into a continuous delivery environment). This work will be carried out across a number of digital products that make up our key Survey Data Collection platform. Specialist role Cyber security consultant Expected Contract Length Likely to be until 31/03/17 at earliest Latest start date 31/10/16 Maximum Day Rate Budget agreed, suppliers to provide candidates at market rate for skill set Who Speclialist Work With The successful candidate will work closely with several multi-disciplinary product development teams to provide guidance and consultation on the outcomes from testing, and share processes, solutions and practices that support secure coding and architecture. A strong technical background is therefore essential, with practical experience of working on solutions (e.g. in software development or system/network/infrastructure architecture and administration). Teams generally consist of a Delivery Manger, Technical Lead, Product Owner and Software Engineers and User Research/Designers. Along with this role's "home" team they will work closely with ONS Information Assurance, evidencing and reassuring that the security patterns of products are to standard What Specialists Work On • Applying security vulnerability and penetration testing on digital products, using manual/automated tools and processes, including static analysis. • Integrating security testing into continuous integration/deployment pipelines. • Promoting secure coding/architecture practices (such as OWASP) & best practice around monitoring and alerting across teams - collaborate to ensure security is built in at all stages • Advising teams on appropriate cryptographic algorithms and formats for data exchange, storage • Communicating new and emerging threats to teams. • Articulating risks/associated threats and how best to mitigate them. • Work with ONS Information Assurance providing evidence to aid their assurance of products Skills & Experience • • Direct experience executing vulnerability and penetration testing, (manual processes automated tools), ideally into a continuous integration/delivery pipeline. Detailed technical knowledge of vulnerabilities, threats, attack methods, and infection vectors. • • Experience working with highly scalable, secure and available systems handling sensitive data, preferably in the Cloud. • • Experience working closely with development teams to ensure secure coding and architecture is a fundamental part of product development. With detailed knowledge of OWASP and other best practices. • • Knowledge of cryptographic algorithms, including encryption, authentication and hashing and experience of applying them in different situations. • Be proficient at holding effective,ongoing technical discussion and input with development teams. Nice to Haves • • Experience investigating suspected attacks and managing security incidents. • • Understanding of Government security standards and Information Assurance processes. • • Crest or CHECK certifications (team leader or team member) • • Certified Ethical Hacker (CEH) • • CISSP or similar familiarity with security architecture • Experience in Physical Security • • Social Engineering • Static program analysis • Linux, Python, Java • Amazon AWS / Cloud environments • • Fuzz testing/fuzzing. Work Location Office for National Statistics Government Buildings Cardiff Road Newport South Wales Working Arrangments Teams are co-located and work in close harmony with daily Agile ceremonies and regular show and tell/stakeholder engagement activities. Consequently, preferred working arrangements are onsite 5 days per week @ ONS Newport office Any amendment to this will be done on a local basis and is likely to be on an infrequent basis. Security Clearance Must have Disclosure Scotland SC Clearance is desirable but not essential No. of Specialists to Evaluate 3 Cultural Fit Criteria • Have experience of working in an Agile delivery environment • Share knowledge and experience with other team members • Be comfortable standing up for their discipline • Work as a team with our organisation and other suppliers • Be transparent and collaborative when making decisions Evaluation Weighting Technical competence 70% Cultural fit 10% Price 20% Questions from Suppliers 1. Would you consider, where desirable for reasons of experience or specialism, at times supplementing or substituting the proposed named Security Engineer with another team member with similar or greater seniority and experience at the same rate? For continuity purposes, the above scenario is not ONS preference. However, we recognise that substitution could be required in exceptional circumstances but the above reads as if it would be the norm. 2. Is it expected that the Security Engineer will be working full time for you for the period stated? Yes the role is required full time for the full duration of the 6 month term, however, it is also recognised that contract staff can apply for and take up other employment during the term given the nature of contracting. 3. If we were successful in placing a candidate for this role, would that prevent us from applying for future development work at ONS due to its nature? No. However, to supplement this, where ONS believes there could be an advantage, an NDA and an ethical walls document will be released and signed before any appointment starts 4. Hi I am trying to apply for this however when I enter a day rate it says day rate already agreed. Is there a price set for candidates? No rate has been set. ONS has requested suppliers provide a market rate for the required skills and experience.