Cyber Risk Lead (Legacy Coordination and Assurance)

Job summary

This role will require the post holder to have SC clearance to start and may be required to undergo Developed Vetting (DV) once in post, therefore successful candidates will be expected to either hold this or be willing to undertake the DV clearance process once in post.

More information on DV clearance is linked here

The Government Cyber Unit's mission is to protect public services from cyber threats and digital resilience failures. We are working to achieve a step change in our cyber and digital resilience across government, through delivery of the Government Cyber Action Plan, and working closely with departments and national technical authorities including the National Cyber Security Centre to deliver. This is a challenging time to be working in cyber security and digital resilience, but we have an incredible opportunity to make a difference to people’s lives and promote national security by protecting the public services and national infrastructure they rely on. We work at the forefront of shaping the UK’s national response to emerging cyber and technology issues - from the increasingly complex range of state-sponsored cyber-attacks and supply chain compromises, through to the transformational benefits and security challenges of frontier AI and quantum computing.

We work closely with the Office of the Chief Technology Officer (OCTO), the directorate responsible for delivering key government technology strategies and initiatives, like the market-shaping Cloud Challenge Book and public sector technology learning through Get Tech Certified. Led by the Government Chief Technology Officer, OCTO sets cross-government technology strategy, technical standards, and shared architectural patterns to drive digital transformation and interoperability across public services.

The problems OCTO is solving

Government runs on technology the public relies on every day, but much of it is ageing, fragmented, and at risk. While government technology has real strengths, its maturity varies significantly across teams, services, and organisations. Some areas are modern, well-run and highly capable; others are still dependent on old systems, fragile infrastructure, and accumulated legacy and technical debt. That's where we come in: our mission is to build Firmer Foundations for Government, a core pillar of the Government's Blueprint for Modern Digital Government. OCTO is working with leaders across government and the wider public sector to mitigate the risks of legacy and ageing technology. New and emerging technologies are part of the answer. They offer better ways to design, build and run services and improve resilience for the public.

Job description

Former DSIT recruitment campaigns are continuing as usual, but candidates should be aware that following theGovernment’s announcement on the changes to some civil service departments, roles will be subject to the machinery of government moves and will ultimately be in one of the new departments. We will provide more information if you are selected for a role. This work remains of high importance to the civil service, and we thank you for your continued interest.

As Cyber Risk Lead (Legacy Coordination and Assurance) you will guide the delivery of legacy and assurance activity, translating the requirements of the Government Cyber Action Plan (GCAP) and Firmer Foundations programme into meaningful actions that drive legacy technology interventions and remediation across government

This role will work across the Accountability and Assurance functions of the Government Cyber Unit (GCU), and the Firmer Foundations of the Office of the Chief Technology Officer (OCTO) – Digital Transformation, Government Digital Service. This role is not primarily a technical specialist or reporting role, it is a strategic integration role for someone who can understand digital, technology and cyber processes, connect workstreams, deliver requirements into delivery teams, and turn complex technical and programme information into clear advice and action to drive forward progress.

Specific responsibilities to include:

• acting as the primary interface between the Accountability and Assurance functions of GCU, and OCTO on legacy-facing and relevant technology modernisation work
• developing strong working relationships across GCU, OCTO, Government Departments, Mayoral Strategic Authorities and wider stakeholders
• translating GCAP outcomes, accountability priorities and assurance requirements into practical requirements for legacy remediation delivery
• developing government’s understanding of legacy risk by bringing together insights from assurance activities, legacy remediation programmes, public sector engagement and broader governance activities
• identifying lessons emerging from successful legacy remediation and legacy reduction activity across the public sector and embedding them in programme delivery
• identifying opportunities for legacy technology interventions to support GCAP outcomes
• identifying where legacy technology risks intersect with wider cyber, operational and organisational risks, ensuring these connections inform policy, governance and assurance activity
• working with the Technology Risk Group (TRG) to align legacy technology initiatives with strategic risk priorities, agreed risk appetite approaches and wider technology risk management objectives

The post holder may be required to support out of hours on call rotas for responding to cyber and digital resilience incidents, for which renumeration and/ or flexible working arrangements will be available.

Person specification

We’re interested in people who can:

• demonstrate analytical and strategic thinking skills relating risk to corporate governance, organisational strategic direction and planning
• build strong relationships with stakeholders across teams, communicating tailored threat information to relevant stakeholders, organisations and stakeholder groups
• identify connections, dependencies and opportunities across multiple workstreams
• translate and communicate complex information to technical and non-technical stakeholders, including senior leaders championing protective security within the wider security function
• demonstrate experience of governance, assurance and risk management and work on major cross-government programmes
• demonstrate knowledge of cyber security, digital transformation, technology risk or organisational resilience helping organisations to derive and reason their security needs

Benefits

There are many benefits of working at DSIT, including:

• flexible hybrid working with flexi-time and the option to work part-time or condensed hours
• a Civil Service Pension with an average employer contribution of 28.97%
• 25 days of annual leave, increasing by a day each year up to a maximum of 30 days
• an extra day off for the King’s birthday
• an in-year bonus scheme to recognise high performance
• career progression and coaching, including a training budget for personal development
• a focus on wellbeing with access to an employee assistance programme
• job satisfaction from making government services easier to use and more inclusive for people across the UK
• advances on pay, including for travel season tickets
• death in service benefits
• cycle to work scheme and facilities
• access to an employee discounts scheme
• 10 learning days per year
• volunteering opportunities (5 special leave days per year)
• access to a suite of learning activities through Civil Service learning

Any move to Government Digital Service from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility at https://www.childcarechoices.gov.uk

Office attendance
The Department operates a discretionary hybrid working policy, which provides for a combination of working hours from your place of work and from your home in the UK. The current expectation for staff is to attend the office or non-home based location for 40-60% of the time over the accounting period.
DSIT does not normally offer full home working (i.e. working at home); but we do offer a variety of flexible working options (including occasionally working from home).

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This role will require the post holder to have SC clearance to start and may be required to undergo Developed Vetting (DV) once in post, therefore successful candidates will be expected to either hold this or be willing to undertake the DV clearance process once in post.

More information on DV clearance is linked here

The standard selection process for roles at DSIT consists of:

• a simple application screening process - We only ask for a CV - Your CV will be assessed against the following criteria
  • demonstrate analytical and strategic thinking skills relating risk to corporate governance, organisational strategic direction and planning
  • translate and communicate complex information to technical and non-technical stakeholders, including senior leaders championing protective security within the wider security function
  • demonstrate experience of governance, assurance and risk management and work on major cross-government programmes
• a 75 minute video interview which will feature a presentation. Details of the presentation will be shared with invited candidates prior to the interview

Depending on how many applications we get, there might also be an extra stage before the video interview, for example a phone interview or a technical exercise.

While we value the use of AI technology to enhance our daily work, we also value the personal touch and urge applicants to write cover letters without the use of AI to emphasise their own unique experiences.

In the event we receive a high volume of applications, we will conduct the initial sift against the lead criteria which is: demonstrate analytical and strategic thinking skills relating risk to corporate governance, organisational strategic direction and planning

In the Civil Service, we use Success Profiles to evaluate your skills and ability. This gives us the best possible chance of finding the right person for the job, increases performance and improves diversity and inclusivity. We’ll be assessing your technical abilities, skills, experience and behaviours that are relevant to this role.

For this role we’ll be assessing you against the following Civil Service Behaviours:

• making effective decisions
• communicating and influencing
• delivering at pace

We’ll also be assessing your experience and specialist technical skills against the following skills defined in the Government Digital and Data Capability Framework for the Lead Cyber Security Governance and Risk Manager role:

• information risk assessment and risk management
• applied security capability
• protective security
• threat understanding

Want to know more about who Government Digital and Data are? Click Here

Recruitment Timeline

Sift completion: 2/12/2026

Panel interviews: Starting 9/12/2026

Candidates that do not pass the interview but have demonstrated an acceptable standard may be considered for similar roles at a lower grade.

A reserve list will be held for a period of 12 months, from which further appointments can be made.

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan and the Civil Service D&I Strategy.

Please note that this role requires SC clearance to start, which would normally need 5 years’ UK residency in the past 5 years. This is not an absolute requirement, but supplementary checks may be needed where individuals have not lived in the UK for that period. This may mean your security clearance (and therefore your appointment) will take longer or, in some cases, not be possible.

For meaningful checks to be carried out, you will need to have lived in the UK for a sufficient period of time, to enable appropriate checks to be carried out and produce a result which provides the required level of assurance. Whilst a lack of UK residency in itself is not necessarily a bar to a security clearance, and expectation of UK residency may range from 3 to 5 years. Failure to meet the residency requirements needed for the role may result in the withdrawal of provisional jobs offers.

Willingness to Obtain Developed Vetting Clearance is needed for this role. More information on DV clearance is linked here

Sponsorship

DSIT cannot offer Visa sponsorship to candidates through this campaign. DSIT holds a Visa sponsorship licence but this can only be used for certain roles and this campaign does not qualify.

Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a basic (or equivalent) criminal record check.Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window).People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see theCivil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).

Apply and further information

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.The Civil Service welcomes applications from people who have recently left prison or have an unspent conviction. Read more about prison leaver recruitment (opens in new window).Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job contact :

• Name : gdsrecruitment@dsit.gov.uk
• Email : gdsrecruitment@dsit.gov.uk

Recruitment team

• Email : gdsrecruitment@dsit.gov.uk

Further information

If you feel your application has not been treated in accordance with the Recruitment Principles and you wish to make a complaint, you should contact gds-complaints@dsit.gov.uk in the first instance.

If you are not satisfied with the response you receive you can contact the Civil Service Commission by email: info@csc.gov.uk Or in writing: Civil Service Commission, Room G/8 1 Horse Guards Road, London, SW1A 2HQ.