Security Information Assurance Consultant

Tender description

Who Speclialist Work With Key stakeholders within Border Force, Home Office Digital Data and Technology, Home Office and Security Services. The programmes are resourced by a range of specialist resources including Home Office Civil Servants and other government Civil Servants. What Specialists Work On The specialist will work in a central role in Borders IT, performing information assurance work to enable key projects to begin and also assure and advise project teams during development. This will involve creating RMADS style documentation to look at threats/risks/mitigations and residual risk for each project and make a recommendation back to business/technology and influence the architecture design. All expected to be cloud hosted in AzureUK with the mix of IaaS, SaaS and PaaS to be determined (and influenced by the security work). Where the Work Takes Place 2 Marsham Street initially then Croydon from summer / autumn 2017 Early Market Engagement Working Arrangements This role requires being physically on site Monday – Friday. Approximate hours are 09:00 – 18:00. Specialists will work primarily on-site with teams as required and report to management on site. Specialists are expected to work across the multiple sites as required. Expenses will conform to HO internal policies and will not be payable to Westminster, Croydon, or Heathrow. Work Location 2 Marsham Street initially then Croydon from summer / autumn 2017 Security Clearance Security clearance of Security Check (SC) is required. Additional T&Cs Skills & Experience Strong experience of security information assurance Methodology. Experience of formulating Information Security Governance Structure. Excellent knowledge of government standards and GPGs. Strong experience with government security policy framework (SPF). Proven background of compiling information assurance frameworks. Experience of preparing and reviewing RMADS and associated documents including the provision of Risk Treatment Plans and recommended remedial activities. Experience of formulating Risk Assessment summaries. Experience with commercial risk assessment methodology e.g. ISF and IRAM Experience with ISO27001:2013 and risk assessment methodology. Ability to manage technical assessments of security related technologies, vulnerability assessments and penetration tools and techniques. Good understanding of risk based architecture and design. Good understand of securing applications, databases, networks and infrastructure. Excellent interpersonal and communication skills. Ability to form and maintain relationships at all levels of engagement. Appreciation of development and project life-cycles, including Agile methods. Experience of formulating and delivering Security Awareness Training. Nice to Haves Experience of working on digital by default service standard compliant government website. No. of Specialists to Evaluate 5 Cultural Fit Criteria Have a flexible attitude and temperament. Transparent and collaborative when making decisions. Work well in a team within our organisation. Have a no-blame culture and encourage people to learn from their mistakes. Mentor members of the team. Assessment Method Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers Budget range