Digital Assurance Practitioner for NOMS Digital Studio

Tender description

Summary of the work An exciting opportunity for talented, tenacious individuals looking to join our team and take lead in creating world-class services in the Prison and Probation environment. You will ensure the secure delivery of high-quality, user-centred products that positively impact the lives of offenders, prison staff and society as a whole. Specialist role Cyber security consultant Expected Contract Length SOW001 dated to 30/06/2017. Subsequent SOWs 3 month durations, up to 24 months. Latest start date 13/02/2017 Who Speclialist Work With - Product Managers to understand information risks for new/existing services. - Delivery teams to address security requirements and break them down into stories and anti-stories. - NOMS Information Assurance team to ensure developed processes are fit for purpose and appropriate Engage with Senior technical and non technical stakeholders including: - The Heads of Assurance and Business Information Assurance Leads - Senior Information Risk Owners (SIROs) and their delegated IAOs Engage with senior technical and non technical stakeholders across Government, including: - The Central Digital Technical Information Assurance Team - Office of CyberSecurity and Information Assurance - GDS - CESG What Specialists Work On The role of a Digital Assurance Practitioner is to work within an agile product team to ensure there are no security reasons affecting the capability of the team to deliver, and to ensure that a product is delivered within the businesses information risk tolerances. To achieve this requires a balanced skill-set between business requirements, secure architectures, policy and risk management. They will ensure that new and updated platforms, products and transactions are thoroughly built and operated securely. They will assist with building a culture of continuous delivery and improvement, ensuring that key systems are regularly risk assessed, maintained and improved. Skills & Experience • Ability to work closely with agile development teams to ensure information security controls and assurances are baked in to Web applications • Ability to carry out risk assessments and risk management following PACE (Pragmatic/Proportionate, Appropriate and Cost-Effective) in line with HMG policy & guidance • Operational security (incident investigation) • Understanding of HMG policy, guidance esp. requirements / controls around the Government Security Policy / Classification (OFFICIAL, SECRET, TOP SECRET) • Security Architecture • Experience working with agile teams incrementally delivering working software • Can submit Candidate CV to kiah_rose.sheppard@justice.gsi.gov.uk by Midday Thursday 2nd February Nice to Haves • CESG Listed Advisor Scheme (CLAS) • ISO27001 Auditor / Implementer • Providing Information security training, education and awareness • Creating policy and guidance • Codes of Connections / IA Conditions • Secure Coding Work Location Greenfield Hse, 32 Scotland St, Sheffield, S3 7DQ (with some time in London) Working Arrangments The role is Sheffield based, but there may be travel involved to other regions of the country including London. There is a £5000 limit on travel expenses: expenses will only be covered for meetings outside of Sheffield. Travel between Sheffield and the supplier’s location will not be covered. Security Clearance Basic Clearance required (disclosure scotland) No. of Specialists to Evaluate 5 Cultural Fit Criteria • We challenge the status quo: we aim to understand the reason behind ‘the way things have always been done’ to see if there is a better way to do things • We respect each other in our different opinions and are constructive in feedback • The unit of delivery is the team - we have no individual heroes, the stars are the teams as whole entities • We aren’t afraid of conflict: we surface tensions and conflict early, and address them promptly • We believe empowered teams deliver the best products: those who are doing the work should and do have the greatest understanding of the work - so ask the team! • We inspect and adapt regularly to continuously improve; learning from failure not blaming individuals • Working product in the hands of users early and often • Products degrade quickly, so we regularly iterate and improvement our products ongoing • Collocating the people, skills and knowledge you need is the best way to deliver • Measure progress by what value you deliver • Keep focus on quality, making sure the whole team is aware of any debt taken on • Keep it simple and do less, whether that for features in the product or the way you are delivering Evaluation Weighting Technical competence 60% Cultural fit 20% Price 20% Questions from Suppliers 1. What is the maximum budget for this? It is not mandatory for us to publish our budget range, and we do not wish to do so. The hope is that candidates will be put forward at rates that truly reflect their technical experience and attitude, not at rates that are put forward in response to a figure published by us. We haven't had any issues with this approach with previous roles - we've found candidates with lower rates than we expected, as well as some above our original budget that are worth a little extra spend. We hope this doesn't prevent any possible applications. Thanks!