Salary - £57,701 - £71,942 (plus a £5000 Digital, Data and Technology (DDaT) pay supplement after a 3 month qualifying period)
Location - Dundee or Glasgow
Hours - 35 hours per week
Closing Date - 7th April 2025 at 23:55
Reference - 965
Employment Type - Permanent
Overview
Are you ready to take the lead in securing cloud environments for a vital public service? Join us as a Principal Cyber Security Analyst within the Digital Risk & Security branch of our Chief Digital Office, where your expertise will guide our commitment to protecting Social Security Scotland. If you are passionate about cloud security and have a keen interest in safeguarding critical information systems, apply now to join our talented team and take the next step in your career.
As the Principal Cyber Security Analyst, you will play a pivotal role in providing technical leadership across our security tooling within our cloud environment. Collaborating closely with cloud engineers and architects, you will oversee the development and implementation of robust cloud security architectures, ensuring compliance with industry best practices across multi-cloud landscapes. This is a key technical leadership position within Digital Risk & Security, focusing on applying proportional security measures to underpin our digital strategy.
Social Security Scotland, an Executive Agency of the Scottish Government, is undertaking the largest and most complex IT and digital change programme since devolution. With a lifetime budget of over £300m, Social Security Scotland is delivering a social security system that will support the people of Scotland for decades to come.
Principal Cyber Security Analysts are responsible for protecting the confidentiality, integrity, and availability of information and information systems used by government and Partners Across Government.
At this role level, you will:
• Initiate and influence relationships with and between key stakeholders, in taking forward all aspects of cyber security, acting as a primary point of contact for senior stakeholders and influencers.
• Manage the assessment and response to cyber threats to maintain confidentiality, integrity, availability, accountability and relevant compliance.
• Operate as a focus for cyber security expertise for the organisation and the wider central government community, providing authoritative advice and guidance on the application and operation of all types of cyber security controls.
• Oversee the work of the cyber security function, including project and task definition and prioritisation, quality management and budgetary control, and management tasks such as recruitment and training.
DDaT Pay Supplement
This post is part of the Scottish Government Digital, Data and Technology (DDAT) profession and as a member of the profession you will join the professional development system. This post currently attracts a £5,000 annual DDAT pay supplement, applicable after a 3 months competency qualifying period. The payment will be backdated to your start date in the role. Pay supplements are reviewed regularly and there is one currently underway. Changes will be communicated when the review is concluded.
Main Duties
• Stakeholder Engagement: Initiate and cultivate relationships with key stakeholders, serving as the primary point of contact for all aspects of cyber security, ensuring comprehensive communication and collaboration.
• Security Control Development: Develop and enforce security controls within Infrastructure as Code (IaC) pipelines, such as Terraform and AWS CloudFormation, ensuring secure-by-design deployments. Embed security into CI/CD pipelines, integrating security testing (SAST, DAST, SCA) and automated compliance checks to enhance security without hindering development velocity.
• Cloud Security Monitoring: Lead initiatives to monitor, assess, and enhance our cloud security posture, leveraging automation to detect and remediate misconfigurations. Develop and operationalise cloud-native security monitoring solutions, integrating SIEM, SOAR, and threat intelligence to enhance detection and response capabilities.
• Cyber Security Expertise: Act as a focal point for cyber security expertise, offering authoritative advice and guidance on the application and operation of various cyber security controls across the organisation and the wider central government community.
• Incident Management: Champion policies and processes for incident management, investigation, and response. Proactively manage the assessment and response to cyber threats, ensuring the confidentiality, integrity, and availability of our information systems.
• Strategic Delivery: Deliver specific pieces of work resulting from the Cyber Security Strategy related to cyber business risk. Design and embed cloud security tooling capabilities to enable our digital roadmap.
• Risk Assessment and Management: Deliver comprehensive risk assessments for complex scenarios, integrating insights into the broader risk management process and aligning risk considerations with corporate governance frameworks.
• Policy Development: Develop cyber security policies, standards, and guidelines that reflect business, technological, and legal requirements, adhering to best practices and industry standards.
Further Information
Social Security Scotland are a Disability Confident Employer. We will consider and implement any reasonable adjustments you may require throughout the recruitment process and during the course of your employment, should you be successful in securing a post. If you feel you may require assistance with any part of our recruitment process, please contact us at Recruitment@socialsecurity.gov.scot.