WP1363 Security Architect

Tender description

Summary of the work Working with delivery teams to ensure that security is considered in the architecture. Create and communicate security policy within GDS. Run threat modelling exercises with teams. This role is outside of IR35. Specialist role Cyber security consultant Expected Contract Length 18 weeks Latest start date Monday 26 June 2017 Maximum Day Rate £850 (Exc. VAT) per day Early Market Engagement None Who Speclialist Work With You will be working within a core team of security specialists including: security engineers, security architect, security operations, security analyst, security intelligence analyst, ethical hacker. The wider 'matrix managed' team that is made up of tech architects, developers, user support managers, product managers, delivery managers and the Enabling Delivery and Support team. What Specialists Work On Alpha deliverables: Create and communicate security policy within GDS and externally across government. Guide and work with the security team to build prototypes for secrets management problems: *Solution tailored to type of secret being stored. *SSH Key management & rotation. Guide and work with the security team to: -build an AWS account management solution for specific teams consistent to GDS TechOps goals; -create Build Pipelines with push button deploy, authorisation and access control for specific teams; -setup Egress Proxying for specific teams; -Set up AWS base images; Speak to teams in formal and informal settings to create awareness. Skills & Experience • At least 2 years - Possess technical knowledge in realms such as security engineering, authentication, security protocols or cryptography. • At least 2 years - Possess knowledge of system security vulnerabilities and remediation techniques. • At least 2 years experience of working within a software development team/writing code • At least 2 years experience working across teams with technical specialists • At least 2 years taking a risk-based approach to decision making • At least 2 years - Familiar with public cloud offerings and how systems can be developed securely using these tools (e.g. NCSC Cloud Security Principles https://www.ncsc.gov.uk/guidance/implementing-cloud-security-principles) Nice to Haves • At least 2 years Software engineering skills, including experience building, managing and deploying modern technical systems. • At least 2 years Experience of managing security in an environment with frequent change • At least 2 years Well recognised security certifications or training • At least 2 years Experience with penetration testing, network security monitoring or incident response • At least 2 years Experience of configuration management processes and tools - e.g. Puppet or Chef Experience of working with PCI environments Work Location Government Digital Service Aviation House 125 Kingsway London WC2B 6NH until mid June 2017. Whitechapel building, Aldgate, London from mid June 2017. Working Arrangments Onsite, co-located with the core team. There may be some need for travel to other government/third parties for reference visits - only when needed. The latest start date to allow for any delays in the procurement process is 26th June 2017. Security Clearance SC clearance Additional T&Cs DOS Terms and conditions will apply, the only addition, if required, would be Cabinet Office T&S Policy will apply for any Supplier expenses which will need to be pre-approved by Cabinet Office No. of Specialists to Evaluate 3 Cultural Fit Criteria • Work as a team with our organisation and other suppliers • Be transparent and collaborative when making decisions • Have a no-blame culture and encourage people to learn from their mistakes • Take responsibility for their work • Share knowledge and experience with other team members • Challenge the status quo • Be comfortable standing up for their discipline • Can work with clients with low technical expertise Evaluation Weighting Technical competence 55% Cultural fit 15% Price 30% Questions from Suppliers 1. Can you please specify the which software development or coding skills are needed for this role(e.g. Java, C++, .Net, Ruby on rails etc etc) At GDS we mostly use a mixture of Ruby, Python and Java. Knowledge of at least one would be necessary and understanding more would be helpful. 2. If the candidates does not have any valid certification and has only attended training's, will such a candidate be considered for this role? We'd consider someone without certifications if they had sufficient appropriate experience. 3. Is this role more focused on Cloud security, network security or is this a general web based cyber security consultant role ? Please specify At GDS we build systems which run mostly on public cloud providers (e.g. AWS). Knowledge of building secure systems in these environments would be required. 4. Any specific tool or technology on which the candidate should have experience on? Please specify. No specific tool or technology experience is required. 5. As roles WP1362 (#2535) and WP1363 (#2529) are identical, can we submit evidence once to be considered for both opportunities or do we need to apply to each separately? You need to apply to each separately 6. Would you be requiring a copy of the specialist CV at this stage? If yes, please let us know what email address to send this to. No we require you to apply with shortlisting evidence.