JOB SUMMARY

The Government Digital Service (GDS) is the digital centre of government. We are responsible for setting, leading and delivering the vision for a modern digital government.

Our priorities are to drive a modern digital government, by:

• joining up public sector services
• harnessing the power of AI for the public good
• strengthening and extending our digital and data public infrastructure
• elevating leadership and investing in talent
• funding for outcomes and procuring for growth and innovation
• committing to transparency and driving accountability

We are home to the Incubator for Artificial Intelligence (I.AI), the world-leading GOV.UK and at the forefront of coordinating the UK’s geospatial strategy and activity. We lead the Government Digital and Data function and champion the work of digital teams across government.
We’re part of the Department for Science, Innovation and Technology (DSIT) and employ more than 1,000 people all over the UK, with hubs in Manchester, London and Bristol.
The Information Security team at GDS protects the people, services and information used to deliver critical government digital infrastructure such as GOV.UK and One Login. We do this by supporting a secure software development lifecycle, setting and checking proportional organisation policies and building a positive, no-blame security culture across the organisation.
The Government Digital Service is where talent translates into impact. From your first day, you’ll be working with some of the world’s most highly-skilled digital professionals, all contributing their knowledge to make change on a national scale.
Join us for rewarding work that makes a difference across the UK. You’ll solve some of the nation’s highest-priority digital challenges, helping millions of people access services they need

JOB DESCRIPTION

GDS is looking to recruit a Head of Security Architecture. This will involve engaging internally in GDS and across government on critical areas of work. The Head of Security Architecture will be an experienced Security professional with extensive technical, strategic and management experience. The individual should have the appropriate level of experience and gravitas to brief the CISO and interact at C-level.

As Head of Security Architecture in the GDS Information Security team, you’ll be responsible for:

• delivering a security architecture advice service to GDS service teams, covering concepts such as securing service architecture and the software development lifecycle, infrastructure as code, policy as code approaches, steps toward zero trust, etc.and others security concepts
• implementing the GDS Secure by Design principles in operational services
• leading the security component of cross-business initiatives on Privileged Access Management, including effective Identity solutions and use of Privileged Access Workstations
• developing common, workable patterns for enterprise-level guardrails and application patterns enabling secure delivery of digital services at scale, in consultation with technical experts across the business
• engaging with the whole Enterprise architecture team across GDS, ICS, DSIT and Cabinet Office to provide consistent design and design governance, with accountability under the GDS Product Group Chief Information Security Officer
• ensuring the multi-year vision for security architectural strategy is in place and is aligned with the wider IT strategy
• ensuring that GDS Product Group has the relevant policies and approaches for security architecture to counteract threats in accordance with our risk profiles, meeting legislation and regulation as a minimum
• leading a Community of Practice for Security Architects, ensuring a quality and consistent approach across teams that may include service security architects in different management chains
• influencing senior managers to adopt secure architectural principles to reduce information risk and to migrate legacy and existing systems into a secure architectural framework

INDICATIVE PROFESSIONAL QUALIFICATIONS / ACCREDITATIONS

• Relevant industry qualifications and accreditations e.g. Certified Cyber Professional (CCP), CREST Registered Technical Security Architect, BCS Practitioner Certificate in Information Assurance Architecture, ISC(2) Information Systems Security Architecture Professional, CISSP, CISM, or other relevant qualifications.

NATIONALITY REQUIREMENTS

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements

FOR MEANINGFUL CHECKS TO BE CARRIED OUT, YOU WILL NEED TO HAVE LIVED IN THE UK FOR A SUFFICIENT PERIOD OF TIME, TO ENABLE APPROPRIATE CHECKS TO BE CARRIED OUT AND PRODUCE A RESULT WHICH PROVIDES THE REQUIRED LEVEL OF ASSURANCE. WHILST A LACK OF UK RESIDENCY IN ITSELF IS NOT NECESSARILY A BAR TO A SECURITY CLEARANCE, AND EXPECTATION OF UK RESIDENCY MAY RANGE FROM 3 TO 5 YEARS. FAILURE TO MEET THE RESIDENCY REQUIREMENTS NEEDED FOR THE ROLE MAY RESULT IN THE WITHDRAWAL OF PROVISIONAL JOBS OFFERS.

Feedback will only be provided if you attend an interview or assessment.

As Head of Security Architecture in the GDS Information Security team, you’ll be responsible for:

• delivering a security architecture advice service to GDS service teams, covering concepts such as securing service architecture and the software development lifecycle, infrastructure as code, policy as code approaches, steps toward zero trust, etc.and others security concepts
• implementing the GDS Secure by Design principles in operational services
• leading the security component of cross-business initiatives on Privileged Access Management, including effective Identity solutions and use of Privileged Access Workstations
• developing common, workable patterns for enterprise-level guardrails and application patterns enabling secure delivery of digital services at scale, in consultation with technical experts across the business
• engaging with the whole Enterprise architecture team across GDS, ICS, DSIT and Cabinet Office to provide consistent design and design governance, with accountability under the GDS Product Group Chief Information Security Officer
• ensuring the multi-year vision for security architectural strategy is in place and is aligned with the wider IT strategy
• ensuring that GDS Product Group has the relevant policies and approaches for security architecture to counteract threats in accordance with our risk profiles, meeting legislation and regulation as a minimum
• leading a Community of Practice for Security Architects, ensuring a quality and consistent approach across teams that may include service security architects in different management chains
• influencing senior managers to adopt secure architectural principles to reduce information risk and to migrate legacy and existing systems into a secure architectural framewor

The standard selection process for roles at GDS consists of:

• a simple application screening process - We only ask for a CV and answers to three specific questions.
• a 90 video interview, to include a 10-minute presentation, the topic to be sent to you one week prior to intervie

For this role we’ll be assessing you against the following Civil Service Behaviours:

• changing and improving
• making effective decisions
• leadership
• seeing the bigger picture
• communicating and influencin

We’ll also be assessing your experience and specialist technical skills against the following skills defined in the Government Digital and Data Capability Framework for the Security architect - Government Digital and Data Profession Capability Framework role.

• Analysis
• Communication (Security Architect)
• Designing Secure Systems
• Enabling and informing risk-based decisions
• Research & Innovation
• Security Technology
• Understanding security implications of transformatio