DWP - Agile Security Testing

Tender description

Why the Work is Being Done In order to ensure that this key DWP application is able to support the scaling and security requirements, it is being re-engineered for resilience and to allow it to operate in a commodity cloud hosting environment. In support of this, an Agile and adaptable programme of PEN testing/vulnerability assessment is required to enable the overall vulnerability management process. Problem to Be Solved The scaling and security goals for the application have led to a strategy of commodity cloud hosting. There is a need to assess the application (release candidates) for vulnerabilities on an ongoing basis, additionally to automate security testing. Who Are the Users Universal Credit Claimants will use the system to mange and progress their claim online. DWP Job Centre and Services Centre Agents will use the system to perform their roles in support of the Universal Credit Applicants. Early Market Engagement Work Already Done Work to deliver a Minimum Viable Product (MVP) is concluding. Existing Team The supplier will be working as a part of a multi-disciplinary team dedicated to the work to migrate the service to a commodity cloud platform. This team consists of internal DevOps, QA, network engineers, Security and delivery / project managers. The team is 10 strong and follows agile processes to prioritise and manage the activities. Current Phase Discovery Work Location Caxton House, Tothill Street, London, SW1H 9NA Working Arrangments On-site in London office for the majority of the time with some scope for remote working. The collaborative nature of the team means that face to face interaction and presence at daily stand-ups is essential. Security Clearance Security Check (SC) Clearance. Additional T&Cs DWP additional terms and conditions are specified on our e-procurement system Bravo; https://dwp.bravosolution.co.uk/web/login.shtml Skills & Experience Experience of undertaking vulnerability assessment and PEN tests, for highly resilient, highly available applications - 5% Extensive, demonstrable knowledge of system security vulnerabilities and remediation techniques. - 5% Experience of introducing/undertaking both automated and manual application PEN testing/vulnerability assessment. - 5% Experience of PEN testing/vulnerabilty assessment within Agile enviroments with Coninuous Integration (CI) pipelines. - 5% Experience of testing applications with large microservice architectures, including API testing. - 5% Experienced CHECK and or CREST certified Application Tester. - 5% Capacity to supply, experienced PEN Tester with technical skills (>3 years’ experience) in Terraform, puppet, github, bash, python, java, Mongo, ActiveMQ, microservice architectures, commodity cloud environments. - 5% Have experience of working within DWP or a comparable organisation within the last 3 years - 4% Nice to Haves Ability to provide technical leadership in multi-supplier team environments. - 3% Experience working with AWS - 3% No. of Suppliers to Evaluate 3 Proposal Criteria Provide details of how you will taylor your service to accommodate the provision of a testing engineering/development capability within the context of vulnerability assessment using agile methodologies. - 6% Clarify how your expierence will enable you to deliver PEN testing/vulnerability assessment services in this context, clarifying how your resources will add value, delivery focus and technical leadership.- 6% Clarify how your resources will work with other parallel work streams, ensuring quality standards are maintained-6% Describe how you will gain at pace, a detailed understanding of the service and project requirements to allow rapid involvement in design and decision activities-6% Describe what processes you will use for the identification of risks and dependencies and the approaches to manage them- 6% Cultural Fit Criteria Based on your past experience, please outline your ability to respond to and align with the culture of the project -5% Payment Approach Capped time and materials Assessment Method Written proposal Work history Presentation Evaluation Weighting Technical competence 75% Cultural fit 5% Price 20% Questions from Suppliers Budget range