Home Office - Her Majesty's Passport Office - Information Assurance Architect

Tender description

Who Speclialist Work With They will work as part of a Technical Design Authority who are responsible for specific domains. They will need to collaborate closely with delivery teams and business stakeholders across the enterprise in a multi-supplier environment. HMPO is moving from a large outsourced SI arrangement to an in-house, largely cloud based and open source based solutions delivered iteratively. What Specialists Work On Work packages include, but aren't limited to: • Ensure that specified security controls or other counter-measures they specify to mitigate, minimise, or treat discovered risks are pragmatic appropriate and cost effective • Lead information assurance activities against solution designs to ensure they are appropriately secure. and provide advice and guidance on HMPO Security standards and policies • Ensure risks are identified, assessed and managed appropriate to HMPO standards and requirements. • Management of operational security incidents, IT Health Check and Pen Tests Assure results of ITHC & Pen Tests Where the Work Takes Place London Early Market Engagement Working Arrangements Typically on-site with wider team and clients in an Agile environment. Some site visits. Use of Confluence, Jira and Ardoq are the tools used to track progress against deliverables We work in an engaging and collaborative environment where outputs require teams to own deliverables Work Location London Security Clearance ‘SC Clearance is required. HM Passport Office will support the clearance process’ Additional T&Cs Skills & Experience Have proven track record of risk assessing and assuring cloud based architectures for large and complex organisations in depth understanding of traditional security technologies and security specific protocols (e.g. TLS, Kerberos and SAML.. Solid experience and understanding of AWS security tools and services, open source security controls, automated security testing tools Proven track record of scoping pen testing, ITHC and security incident management in depth understanding and experience of outcome based approach to risk identification, management and mitigation using techniques such as risk trees and attack tree methods Good understanding of Identity management, identity lifecycle management Nice to Haves 1. Experience of HMPO systems or similar government operational systems Experience of GDS best practices No. of Specialists to Evaluate 3 Cultural Fit Criteria Work as a team with our organisation and other suppliers Be transparent and collaborative Be comfortable standing up for their discipline Have a no-blame culture and take responsibility for their work Assessment Method Interview Evaluation Weighting Technical competence 60% Cultural fit 20% Price 20% Questions from Suppliers Budget range the maximum day rate has been left blank intentionally, we will assess the day rate for suppliers using the evaluation weighting we have disclosed on the requirements.