Digital Assurance Practitioner for NOMS Digital Studio

Tender description

Summary of the work An exciting opportunity for talented, tenacious individuals looking to join our team and take lead in creating world-class services in the Prison and Probation environment. You will ensure the secure delivery of high-quality, user-centred products that positively impact the lives of offenders, prison staff and society as a whole. Specialist role Cyber security consultant Expected Contract Length SOW001 dated to 30/06/2017. Subsequent SOWs set at 3 months duration, up to 24 months maximum. Latest start date 27/03/2017 Who Speclialist Work With - Product Managers to understand information risks for new/existing services. - Delivery teams to address security requirements and break them down into stories and anti-stories. - NOMS Information Assurance team to ensure developed processes are fit for purpose and appropriate Engage with Senior technical and non technical stakeholders including: - The Heads of Assurance and Business Information Assurance Leads - Senior Information Risk Owners (SIROs) and their delegated IAOs Engage with senior technical and non technical stakeholders across Government, including: - The Central Digital Technical Information Assurance Team - Office of CyberSecurity and Information Assurance - GDS - CESG What Specialists Work On he role of a Digital Assurance Practitioner is to work within an agile product team to ensure there are no security reasons affecting the capability of the team to deliver, and to ensure that a product is delivered within the businesses information risk tolerances. To achieve this requires a balanced skill-set between business requirements, secure architectures, policy and risk management. They will ensure that new and updated platforms, products and transactions are thoroughly built and operated securely. They will assist with building a culture of continuous delivery and improvement, ensuring that key systems are regularly risk assessed, maintained and improved. Skills & Experience • Ability to work closely with agile development teams to ensure information security controls and assurances are baked in to Web applications • Ability to carry out risk assessments and risk management following PACE (Pragmatic/Proportionate, Appropriate and Cost-Effective) in line with HMG policy & guidance • Operational security (incident investigation) • Understanding of HMG policy, guidance esp. requirements / controls around the Government Security Policy / Classification (OFFICIAL, SECRET, TOP SECRET) • Security Architecture • Experience working with agile teams incrementally delivering working software • Candidate must complete a Skills & Evidence template and provide CV to kiah_rose.sheppard@justice.gsi.gov.uk by COP Friday 10th March. See Q&A for guidance. Nice to Haves • CESG Listed Advisor Scheme (CLAS) • ISO27001 Auditor / Implementer • Providing Information security training, education and awareness • Creating policy and guidance • Codes of Connections / IA Conditions • Secure Coding Work Location Greenfield Hse, 32 Scotland St, Sheffield, S3 7DQ (with some time in London) Working Arrangments The role is Sheffield based, but there may be travel involved to other regions of the country including London. There is a £5000 limit on travel expenses: expenses will only be covered for meetings outside of Sheffield. Travel between Sheffield and the supplier’s location will not be covered. Security Clearance Basic Clearance required (disclosure scotland) No. of Specialists to Evaluate 5 Cultural Fit Criteria • Keep it simple and do less, whether that for features in the product or the way you are delivering • Collocating the people, skills and knowledge you need is the best way to deliver • Everyone is responsible for quality • Keep focus on quality, making sure the whole team is aware of any debt taken on • Measure progress by what value you deliver • Products degrade quickly, so we regularly iterate and improvement our products ongoing • The unit of delivery is the team - we have no individual heroes, the stars are the teams as whole entities • We aren’t afraid of conflict: we surface tensions and conflict early, and address them promptly • We believe empowered teams deliver the best products: those who are doing the work should and do have the greatest understanding of the work - so ask the team! • We challenge the status quo: we aim to understand the reason behind ‘the way things have always been done’ to see if there is a better way to do things • We inspect and adapt regularly to continuously improve • We respect each other in our different opinions and are constructive in feedback • Working product in the hands of users early and often Evaluation Weighting Technical competence 50% Cultural fit 20% Price 30% Questions from Suppliers 1. Skills & Evidence Template https://docs.google.com/document/d/1grf4T5kNpAkGi5gP1WNfjj3oPEQjNqxhBnna2Q0vuPY/edit?usp=sharing 2. *Skills & Evidence - Shortlisting Process Guidance 1 of 2* Due to the recent added functionality of the Skills & Evidence step when submitting a candidate via the portal, we have slightly changed our shortlist and evaluation processes to reflect this: - Shortlist: Skills & Evidence template - Evaluation step 1: CV - Evaluation step 2: (optional) Telephone interview - Evaluation step 3: Interview Please complete the Skills & Evidence templates for your candidates - send any additional templates to kiah_rose.sheppard@justice.gsi.gov.uk 3. *Skills & Evidence - Shortlisting Process Guidance 2 of 2* We will continue to ask for CVs to be submitted in line with the opportunity deadline. This is to streamline the process and minimise the time between an opportunity closing and contract award. If you are submitting more than one candidate, please ensure you submit via email both their CV and Skills & Evidence template, and that it is clear in both the email and the file names. If there are any questions, issues, or feedback, please contact me on kiah_rose.Sheppard@justice.gsi.gov.uk