Principal Cyber Security Analyst @ Scottish Government

Scottish Government

The devolved government for Scotland has a range of responsibilities that include: the economy, education, health, justice, rural affairs, housing, environment, equal opportunities, consumer advocacy and advice, transport and taxation.

Are you ready to take the lead in securing cloud environments for a vital public service? Join us as a Principal Cyber Security Analyst within the Digital Risk & Security branch of our Chief Digital Office, where your expertise will guide our commitment to protecting Social Security Scotland. If you are passionate about cloud security and have a keen interest in safeguarding critical information systems, apply now to join our talented team and take the next step in your career.

As the Principal Cyber Security Analyst, you will play a pivotal role in providing technical leadership across our security tooling within our cloud environment. Collaborating closely with cloud engineers and architects, you will oversee the development and implementation of robust cloud security architectures, ensuring compliance with industry best practices across multi-cloud landscapes. This is a key technical leadership position within Digital Risk & Security, focusing on applying proportional security measures to underpin our digital strategy.

Principal Cyber Security Analysts are responsible for protecting the confidentiality, integrity, and availability of information and information systems used by government and Partners Across Government.

At this role level, you will:

• Initiate and influence relationships with and between key stakeholders, in taking forward all aspects of cyber security, acting as a primary point of contact for senior stakeholders and influencers.
• Manage the assessment and response to cyber threats to maintain confidentiality, integrity, availability, accountability and relevant compliance.
• Operate as a focus for cyber security expertise for the organisation and the wider central government community, providing authoritative advice and guidance on the application and operation of all types of cyber security controls.
• Oversee the work of the cyber security function, including project and task definition and prioritisation, quality management and budgetary control, and management tasks such as recruitment and training.

Responsibilities

• Stakeholder Engagement:Initiate and cultivate relationships with key stakeholders, serving as the primary point of contact for all aspects of cyber security, ensuring comprehensive communication and collaboration.
• Security Control Development:Develop and enforce security controls within Infrastructure as Code (IaC) pipelines, such as Terraform and AWS CloudFormation, ensuring secure-by-design deployments. Embed security into CI/CD pipelines, integrating security testing (SAST, DAST, SCA) and automated compliance checks to enhance security without hindering development velocity.
• Cloud Security Monitoring:Lead initiatives to monitor, assess, and enhance our cloud security posture, leveraging automation to detect and remediate misconfigurations. Develop and operationalise cloud-native security monitoring solutions, integrating SIEM, SOAR, and threat intelligence to enhance detection and response capabilities.
• Cyber Security Expertise:Act as a focal point for cyber security expertise, offering authoritative advice and guidance on the application and operation of various cyber security controls across the organisation and the wider central government community.
• Incident Management:Champion policies and processes for incident management, investigation, and response. Proactively manage the assessment and response to cyber threats, ensuring the confidentiality, integrity, and availability of our information systems.
• Strategic Delivery:Deliver specific pieces of work resulting from the Cyber Security Strategy related to cyber business risk. Design and embed cloud security tooling capabilities to enable our digital roadmap.
• Risk Assessment and Management:Deliver comprehensive risk assessments for complex scenarios, integrating insights into the broader risk management process and aligning risk considerations with corporate governance frameworks.
• Policy Development:Develop cyber security policies, standards, and guidelines that reflect business, technological, and legal requirements, adhering to best practices and industry standards.

Essential Experience

• Experience in delivering technical leadership to teams and can develop and operationalise techniques in line with cloud security best practice, e.g. automating orchestration and configuration of cloud security tooling.
• Demonstrated ability to deliver balanced and cost-effective risk management decisions on situations with complex scope or significant risk and ensuring risk is embedded into corporate governance frameworks.

Technical / Professional Skills:
This role is aligned to Cyber Security Analyst Principal within the Digital, Data and Technology Profession. Please review the following to understand the skill expectations: Cyber security: operations - gov.scot.

We will assess you against the following technical skills during the selection process:

• Cyber security operations - Level: Expert
• Specific security technology and understanding - Level: Expert
• Incident management, incident investigation and response - Level: Expert
• Information risk assessment and risk management - Level: Expert

How to Apply
Apply online, providing a CV and Supporting Statement (of no more than 750 words) which provides evidence of how you meet the skills, experience and behaviours listed in the Success Profile above.

We will test your behaviours, technical skills and experience as part of the sift process, and if successful, you will be invited to an assessment and interview where we will test these again. Full details of the selection process will be made available to shortlisted candidates once the sift has been completed.

Information Session
We will be hosting an online Information Session on Thursday 3rd April at 1.30 – 2.30pm.
We will be talking about the Principal Cyber Security Analyst role and DRS Security Operations team.

Equality Statement
Social Security Scotland are committed to equality and inclusion, and we aim to recruit a diverse workforce that reflects the population of our nation.

#J-18808-Ljbffr