Principal Cyber Security Analyst

Are you ready to take the lead in securing cloud environments for a vital public service? Join us as a Principal Cyber Security Analyst within the Digital Risk & Security branch of our Chief Digital Office, where your expertise will guide our commitment to protecting Social Security Scotland. If you are passionate about cloud security and have a keen interest in safeguarding critical information systems, apply now to join our talented team and take the next step in your career.

As the Principal Cyber Security Analyst, you will play a pivotal role in providing technical leadership across our security tooling within our cloud environment. Collaborating closely with cloud engineers and architects, you will oversee the development and implementation of robust cloud security architectures, ensuring compliance with industry best practices across multi-cloud landscapes. This is a key technical leadership position within Digital Risk & Security, focusing on applying proportional security measures to underpin our digital strategy.

Social Security Scotland, an Executive Agency of the Scottish Government, is undertaking the largest and most complex IT and digital change programme since devolution. With a lifetime budget of over £300m, Social Security Scotland is delivering a social security system that will support the people of Scotland for decades to come. 

We aim to develop within Social Security Scotland, a positive and inclusive culture, which supports our people to flourish, by embedding a working environment where we all treat each other with dignity and respect and recognise each other’s contributions.

Principal Cyber Security Analysts are responsible for protecting the confidentiality, integrity, and availability of information and information systems used by government and Partners Across Government. 

At this role level, you will: 

• Initiate and influence relationships with and between key stakeholders, in taking forward all aspects of cyber security, acting as a primary point of contact for senior stakeholders and influencers.
• Manage the assessment and response to cyber threats to maintain confidentiality, integrity, availability, accountability and relevant compliance.
• Operate as a focus for cyber security expertise for the organisation and the wider central government community, providing authoritative advice and guidance on the application and operation of all types of cyber security controls.
• Oversee the work of the cyber security function, including project and task definition and prioritisation, quality management and budgetary control, and management tasks such as recruitment and training.

Responsibilities 

• Stakeholder Engagement: Initiate and cultivate relationships with key stakeholders, serving as the primary point of contact for all aspects of cyber security, ensuring comprehensive communication and collaboration.
• Security Control Development: Develop and enforce security controls within Infrastructure as Code (IaC) pipelines, such as Terraform and AWS CloudFormation, ensuring secure-by-design deployments.  Embed security into CI/CD pipelines, integrating security testing (SAST, DAST, SCA) and automated compliance checks to enhance security without hindering development velocity.
• Cloud Security Monitoring: Lead initiatives to monitor, assess, and enhance our cloud security posture, leveraging automation to detect and remediate misconfigurations. Develop and operationalise cloud-native security monitoring solutions, integrating SIEM, SOAR, and threat intelligence to enhance detection and response capabilities.
• Cyber Security Expertise: Act as a focal point for cyber security expertise, offering authoritative advice and guidance on the application and operation of various cyber security controls across the organisation and the wider central government community.
• Incident Management: Champion policies and processes for incident management, investigation, and response. Proactively manage the assessment and response to cyber threats, ensuring the confidentiality, integrity, and availability of our information systems.
• Strategic Delivery: Deliver specific pieces of work resulting from the Cyber Security Strategy related to cyber business risk. Design and embed cloud security tooling capabilities to enable our digital roadmap.
• Risk Assessment and Management: Deliver comprehensive risk assessments for complex scenarios, integrating insights into the broader risk management process and aligning risk considerations with corporate governance frameworks. 
• Policy Development: Develop cyber security policies, standards, and guidelines that reflect business, technological, and legal requirements, adhering to best practices and industry standards.

Success Profiles
We use an assessment framework called ‘Success Profiles’ which lists the elements we test and provides detailed descriptions of each. Find out more about how we assess the Success Profile elements.

Essential Experience 

1. Experience in delivering technical leadership to teams and can develop and operationalise techniques in line with cloud security best practice, e.g. automating orchestration and configuration of cloud security tooling. 
2. Demonstrated ability to deliver balanced and cost-effective risk management decisions on situations with complex scope or significant risk and ensuring risk is embedded into corporate governance frameworks. 

Technical / Professional Skills:  
This role is aligned to Cyber Security Analyst Principal within the Digital, Data and Technology Profession. Please review the following to understand the skill expectations: Cyber security: operations - gov.scot

We will assess you against the following technical skills during the selection process:                                                                              

• Cyber security operations - Level: Expert                                                      
• Specific security technology and understanding - Level: Expert                         
• Incident management, incident investigation and response - Level: Expert
• Information risk assessment and risk management    - Level: Expert

Please note that only the first 2 technical skills listed will be tested at application stage: Cyber security operations and Specific security technology and understanding   

Behaviours 

• Changing and improving - Level 4
• Leadership - Level 4
• Communicating and influencing - Level 4

You can find out more about Success Profiles Behaviours, here: Success Profiles - Civil Service Behaviours (publishing.service.gov.uk)  

How to Apply
Apply online, providing a CV and Supporting Statement (of no more than 750 words) which provides evidence of how you meet the skills, experience and behaviours listed in the Success Profile above. 

Should a large number of applications be received, an initial sift may be conducted using the CV and personal statement on the experience criteria.

Candidates who pass the initial sift will have their applications fully assessed. 

We will test your behaviours, technical skills and experience as part of the sift process, and if successful, you will be invited to an assessment and interview where we will test these again. Full details of the selection process will be made available to shortlisted candidates once the sift has been completed. 

Following the sift of applications there may be a telephone interview as part of the Assessment process, prior to interview.

Candidates selected for interview will be requested to provide a 10-minute presentation on the technical skills required; Details of which will be shared in advance of the interview.

We aim to provide feedback on request, however; if we receive a large number of applications it may not be possible for us to provide feedback on your application if you are not invited to attend an interview/assessment. We will provide feedback on request to all candidates that attend an interview/assessment.

Information Session
We will be hosting an online Information Session on Thursday 3rd April at 1.30 – 2.30pm.

We will be talking about:

• The Principal Cyber Security Analyst role and DRS Security Operations team
• About Social Security Scotland
• Our recruitment process
• Q&A with the hiring manager

Join us using the link below:
Join the meeting now 

Expected Timeline (subject to change) 
Sift - w/c 7th April 
Interview – w/c 21st April
Location - In Person in either Dundee or Glasgow

Reserve List
In the event that there are more successful candidates than posts available, a reserve list will be kept for up to 12 months.

About us  
Social Security Scotland is an Executive Agency of the Scottish Government. Our benefits help people from all walks of life in Scotland. We offer rewarding careers and employ people across Scotland in a wide range of professions and roles. We are committed to recruiting a diverse workforce that is representative of the clients we serve.  Find more about us here.    

We offer a supportive and inclusive working environment along with a wide range of employee benefits. Find out more about what we offer.  

As part of the UK Civil Service, we uphold the Civil Service Nationality Rules.    

DDaT Pay Supplement 
This post is part of the Scottish Government Digital, Data and Technology (DDAT) profession and as a member of the profession you will join the professional development system.  This post currently attracts a £5,000 annual DDAT pay supplement, applicable after a 3 months competency qualifying period. The payment will be backdated to your start date in the role. Pay supplements are reviewed regularly and there is one currently underway. Changes will be communicated when the review is concluded. 

Working pattern 
Our standard hours are 35 hours per week and we offer a range of flexible working options, depending on the needs of the role. We embrace a hybrid working style where all colleagues will spend time in either our Glasgow or Dundee offices. There is an expectation of a minimum 2 days per week in your assigned location, which will be either Glasgow or Dundee.  If you have specific questions about the role you are applying for, please contact us.  

Equality Statement  
Social Security Scotland are committed to equality and inclusion, and we aim to recruit a diverse workforce that reflects the population of our nation.    

Social Security Scotland are a Disability Confident Employer. We will consider and implement any reasonable adjustments you may require throughout the recruitment process and during the course of your employment, should you be successful in securing a post. If you feel you may require assistance with any part of our recruitment process, please contact us at Recruitment@socialsecurity.gov.scot. 

Find out more about our commitment to diversity and how we offer and support recruitment adjustments for anyone who needs them.  

Further information 
This post requires the successful candidate to clear additional National Security Vetting clearance (Security Check) before a start date can be offered. Further information regarding National Security Vetting clearance can be found here - United Kingdom Security Vetting: Applicant - GOV.UK (United Kingdom Security Vetting: Applicant - GOV.UK)

Find out more about our organisation, what we offer staff members and how to apply on our Careers Website.  

Read our Candidate Guide for further information on our recruitment and application processes.   

The successful candidate will be expected to remain in post for a minimum of 3 years unless successful in gaining promotion to a higher Band or Grade.   
 
Social Security Scotland’s recruitment processes are underpinned by the recruitment principles of the Civil Service Commissioner, which outline that selection for appointment be made on merit on the basis of fair and open competition - Recruitment - Civil Service Commission (independent.gov.uk)   

If you feel at any time your application has not been treated in accordance with the values in the Civil Service Code and/or if you feel the recruitment has been conducted in such a way that conflicts with the Civil Service Commissioner’s Recruitment Principles, you can make a complaint, by contacting Social Security Scotland at recruitment@socialsecurity.gov.scot in the first instance. If you are not satisfied with the response you receive you can contact the Civil Service Commissioner. 

If you experience any difficulties accessing our website or completing the online application form, please contact the Resourcing Team via recruitment@socialsecurity.gov.scot.

Apply before 7th April 2025 at 23.55
Contact Name - Resourcing Team  
Contact email – Recruitment@socialsecurity.gov.scot