Information Security Officer (to June 2017)

Tender description

Summary of the work Providing Information Security and accreditation expertise and support within the HCA. Ensure the HCA remains compliant with ISO27001 and the Security Policy Framework at our Data Centres, as well as ensuring the HCA remains secure against cyber attacks. Specialist role Cyber security consultant Expected Contract Length This is a thirteen week work package Latest start date 03/04/2017 Maximum Day Rate £450 Who Speclialist Work With The specalist will be the only Information Security Professional in the organisation and will need to work closely with the IT Infrastructure and Support Teams to ensure compliance. What Specialists Work On Providing temporary Information Security and accreditation expertise and support until permanent recruitment completed. Ensuring HCA remains compliant with ISO27001 and Security Policy Framework particularly for Gateshead and Warrington Data Centres. Arranging Pen tests. Monitor and record key metrics including cyber attacks, equipment loss, unusual staff internet access. Produce monthly Information Security Report. Ensure completion of BPSS for new non-staff workforce and necessary SC/CTC checks for other staff. Plan the 2017/18 ISMS system and process audits in agreement with the ISMS Management Team, and carry out first quarterly 2017/18 audit. Hand over smoothly to permanent role once they are in post. Skills & Experience • Public Sector Information Security Background • Detailed knowledge of ISO27001 • Experience of ensuring security of the PSN, email, virus protection and Disaster Recovery • A mix of management and technical skills • CISSP Qualified Work Location The worker can generally choose where they work, however the team uses our Gateshead office as a connection point, and there is an expectation that the worker will use this office for project related activities that need their attendance in person. Working Arrangments The worker will manage their own working arrangements as required to deliver the assignment. For reasons of security, the HCA will provide encrypted laptop loaded with secure software. Security Clearance All team members are subject to Baseline Personnel Security Standards checks and for anyone working at the London office, must also be CTC cleared. No. of Specialists to Evaluate 3 Cultural Fit Criteria • Work as part of a team with our organisation and other suppliers • Transparent and collaborative when making decisions • Flexible to changing requirements and needs • Open to suggestions and open to make suggestions • Driven for success with positive and professional attitude Evaluation Weighting Technical competence 40% Cultural fit 20% Price 40% Questions from Suppliers 1. From 6th April, responsibility for determining if an assignment is within IR35 will shift to the Public Sector organisation. [We] need to understand the client’s decision on the status of each contract assignment (including extensions) under IR35 and whether a new contractor assignment is deemed ‘Inside’ or ‘Outside’ of IR35 at the beginning of the recruitment process for hiring a contractor. There is an HMRC status portal available to help determine the status but we do require you to post a response as to whether the role is ‘inside’ or ‘outside’. This is an outside IR35 role. 2. How many days should the worker expect to be onsite at Gateshead? And how many days at other locations, and where are they? The person undertaking this work will need to agree with the wider team how best to deliver the outcomes and therefore the locations and activities associated. Gateshead is the main Data Centre hub and Warrington the secondary, therefore any additional travel could encompass Warrington. It is not expected that there would need to be any regular or frequent attendance to other sites. 3. Can you clarify whether this role will be subject to IR35 or is it out of scope? This is an outside IR35 role. 4. Can you confirm with regards to the IR35 legislation whether this role is inside or outside of the new legislation This is an outside IR35 role. 5. Is there a current incumbent in place. We have packages of work currently underway in this area, but this requirement is a new package of work. 6. What is the likelihood of the work package being extended or the supplier being offered additional work packages? We are actively recruiting a permanent ISO who would pick up this work in the future, as well as other responsibilities. Should this permanent role not be in place at the end of this work package, then those elements which can be delivered as a work package may be offered to the market for a further period 7. We have a consultant who can use local accommodation to deliver the project. However given distance between sites and the need to stay away from home, are we able to agree that where possible fridays would typically be ok for home working please? The worker can generally choose where they work, however because this is a ‘Security Role’ they need to be on-site as required in order to successfully deliver the work package. The exact arrangements will likely differ throughout the lifecycle of the work and therefore we cannot be prescriptive about this. 8. Could you please provide the exact location that the specialist will work. The worker can generally choose where they work, however the team uses our Gateshead office as a connection point, and there is an expectation that the worker will use this office for project related activities that need their attendance in person. 9. will this contract fall under IR35 please? This is an outside IR35 role. 10. Is BPSS & CTC both mandatory or either or ,if candidate has CTC not BPSS can such ones be considered. All team members are subject to Baseline Personnel Security Standards checks, this is mandatory. For anyone working at the London office, they must also be CTC cleared. 11. Can more than 1 candidates be submitted? Given the time limited and focussed nature of this assignment we are looking for a single individual. 12. What is the lead time for feedback once the application is submitted? We are looking to appoint by 03/04 at the latest, therefore are expecting to have made decisions by 30/03. 13. For "A mix of management and technical skills" any more information on any specific Technical Skills please GSi – how the secure gateways workGood understanding on Secure Email routing Successful accreditation for the PSN controls – risk mitigation etcPen Testing/Health ChecksAccrediting systems/solutions