Digital Assurance Practitioner for NOMS Digital Studio

Tender description

Who Speclialist Work With - Product Managers to understand information risks for new/existing services. - Delivery teams to address security requirements and break them down into stories and anti-stories. - NOMS Information Assurance team to ensure developed processes are fit for purpose and appropriate Engage with Senior technical and non technical stakeholders including: - The Heads of Assurance and Business Information Assurance Leads - Senior Information Risk Owners (SIROs) and their delegated IAOs Engage with senior technical and non technical stakeholders across Government, including: - The Central Digital Technical Information Assurance Team - Office of CyberSecurity and Information Assurance - GDS - CESG What Specialists Work On he role of a Digital Assurance Practitioner is to work within an agile product team to ensure there are no security reasons affecting the capability of the team to deliver, and to ensure that a product is delivered within the businesses information risk tolerances. To achieve this requires a balanced skill-set between business requirements, secure architectures, policy and risk management. They will ensure that new and updated platforms, products and transactions are thoroughly built and operated securely. They will assist with building a culture of continuous delivery and improvement, ensuring that key systems are regularly risk assessed, maintained and improved. Where the Work Takes Place Greenfield Hse, 32 Scotland St, Sheffield, S3 7DQ (with some time in London) Early Market Engagement Working Arrangements The role is Sheffield based, but there may be travel involved to other regions of the country including London. There is a £5000 limit on travel expenses: expenses will only be covered for meetings outside of Sheffield. Travel between Sheffield and the supplier’s location will not be covered. Work Location Greenfield Hse, 32 Scotland St, Sheffield, S3 7DQ (with some time in London) Security Clearance Basic Clearance required (disclosure scotland) Additional T&Cs Skills & Experience Ability to work closely with agile development teams to ensure information security controls and assurances are baked in to Web applications Ability to carry out risk assessments and risk management following PACE (Pragmatic/Proportionate, Appropriate and Cost-Effective) in line with HMG policy & guidance Operational security (incident investigation) Understanding of HMG policy, guidance esp. requirements / controls around the Government Security Policy / Classification (OFFICIAL, SECRET, TOP SECRET) Security Architecture Experience working with agile teams incrementally delivering working software Candidate must complete a Skills & Evidence template and provide CV to kiah_rose.sheppard@justice.gsi.gov.uk by COP Friday 10th March. See Q&A for guidance. Nice to Haves CESG Listed Advisor Scheme (CLAS) ISO27001 Auditor / Implementer Providing Information security training, education and awareness Creating policy and guidance Codes of Connections / IA Conditions Secure Coding No. of Specialists to Evaluate 5 Cultural Fit Criteria Keep it simple and do less, whether that for features in the product or the way you are delivering Collocating the people, skills and knowledge you need is the best way to deliver Everyone is responsible for quality Keep focus on quality, making sure the whole team is aware of any debt taken on Measure progress by what value you deliver Products degrade quickly, so we regularly iterate and improvement our products ongoing The unit of delivery is the team - we have no individual heroes, the stars are the teams as whole entities We aren’t afraid of conflict: we surface tensions and conflict early, and address them promptly We believe empowered teams deliver the best products: those who are doing the work should and do have the greatest understanding of the work - so ask the team! We challenge the status quo: we aim to understand the reason behind ‘the way things have always been done’ to see if there is a better way to do things We inspect and adapt regularly to continuously improve We respect each other in our different opinions and are constructive in feedback Working product in the hands of users early and often Assessment Method Evaluation Weighting Technical competence 50% Cultural fit 20% Price 30% Questions from Suppliers Budget range