Summary
As Assistant Director of Cyber Security you will lead and manage a busy cyber function, providing direction and ensuring the delivery of an outcome-focused, professional and high-quality service.
You will be responsible for the operation of the Cyber function, , setting the strategic direction and shaping policies.
You will build working relationships and work with a diverse group of stakeholders, including the Board, communicating in a clear, concise, timely and effective manner.
You will use your expert and extensive knowledge gained through practical experience and expertise, and team management, to oversee and be responsible for the seamless and successful delivery of the service.
You will be responsible for ensuring that all aspects of both cyber governance and people management are carried out, and that cyber is on the agenda from floor to board.
Work Activity Components
| Title | Details |
|---|---|
| Advice and guidance (INAS) (Level Seven) | Leads and guides provision of information assurance requirements across all the organisation's information and information systems. |
| Assurance (GOVN) (Level Six) | Implements the governance framework to enable governance activity to be conducted. Undertakes and/or directs reviews as necessary to ensure management decision-making is transparent, and that an appropriate balance between benefits, opportunities, costs and risks can be demonstrated to principal stakeholders. |
| Body of knowledge (VURE)(Level Six) | Takes a leading role in the development of the security vulnerability research body of knowledge. Initiates frequent communications with peers in other organisations and in other countries, presents keynote papers at conferences, writes for high impact journals and major clients. |
| Business plans (INAS) (Level Seven) | Has significant input to development of business plans, ensuring that information assurance is integrated into business strategy and policies. |
| Career paths and mentoring (PEMT)(Level 6) | Mentors and influences senior individuals in consideration of their career opportunities and contribution to the organisation talent pool. Advises on their career paths, and encourages pro-active development of skills and capabilities. |
| Compliance (SCTY) (Level Seven) | Accountable for business strategy compliance with information security policies. Takes steps to ensure the organisation complies with all relevant security regulations including GDPR. |
| Data privacy and information security culture (INAS) (Level Seven) | Obtains organisational commitment to data information security at the highest level. Establishes a culture where data and information security is the responsibility of every employee. |
| Empowerment and role model (PEMT)(Level 6) | Facilitates effective working relationships within and between senior staff. Motivates, engages with, influences and empowers senior staff. Acts as a role model for senior staff and staff at all levels across the organisation, setting a high standard, acting professionally at all times and working to the highest levels of conduct and ethics. |
| Governance (GOVN) (Level Six) | Leads reviews of governance practices with appropriate and sufficient independence from management activity. Within a defined area of accountability, determines the requirements for the appropriate governance of the specific domains, ensuring clarity of responsibilities and authority, goals and objectives. |
| Guidance, performance and feedback (PEMT)(Level 6) | Optimises performance of senior staff, measuring and reporting on performance against agreed high level strategy and key performance indicators. Collects data on the performance of senior staff. Gives regular feedback to senior teams as to their contribution towards organisational performance and strategy. |
| Implementation and processes (INAS) (Level Seven) | Ensures that the organisation implements processes to take forward the information assurance strategy and policies, and improve information security maturity. |
| Influencing partners (INAS) (Level Seven) | Influences key partner organisations to maintain information assurance policies and practices in line with those of own organisation. |
| Leadership and management (SCTY) (Level Six) | Manages IT security specialist staff, including approval of project and task definition and prioritisation, quality management and budgetary control, and management tasks such as recruitment and training when required. |
| Networking and communities (VURE)(Level Six) | Maintains a strong external network. Takes a leading part in external-facing professional activities to facilitate information gathering. |
| People processes (PEMT)(Level 6) | Participates, as appropriate, in formal processes such as compensation negotiations and disciplinary procedures. |
| Policy and strategy (SCTY) (Level Seven) | Directs the development, implementation, delivery and support of an enterprise information security strategy aligned to the strategic requirements of the business, and consistent with relevant IT and business plans, budgets, strategies etc. |
| Reporting (VURE)(Level Six) | Engages with, and influences, relevant stakeholders to communicate results of research and the required response. |
| Research activities (VURE)(Level Six) | Plans and leads the organisation's approach for vulnerability research. Identifies new and emerging threats and vulnerabilities. |
| Risk countermeasures and response (BURM) (Level Six) | Advises on the evaluation of identified risks (including probability/frequency of occurrence, impact and severity). Advises on appropriate action, including contingency planning, and countermeasures. |
| Risk strategy, processes and monitoring (BURM) (Level 5) | Monitors status of risks, and reports status and need for action to key stakeholders. |
| Security architecture (SCTY) (Level Seven) | Leads the development of the corporate security architecture, securing business leadership support and commitment to deliver, maintain and continuously improve security practises to provide effective protection of corporate information and systems assets. |
| Security expertise (SCTY) (Level Seven) | Takes responsibility for the delivery of IT security expertise for the organisation, providing authoritative advice and guidance on the application and operation of all types of security control, including legislative or regulatory requirements such as data protection/GDPR and software copyright law. Acts as the organisation's data protection officer for the purposes of GDPR legislation. |
| Strategy (INAS) (Level Seven) | Accountable for establishing and managing information assurance strategy and policies in accordance with the ISO/IEC 27000 series of standards and/or other external and internal guidance relevant to own organisation. |
| Team dynamics (PEMT)(Level 6) | Champions the importance of skill mix and the understanding of team dynamics to successful team creation, development, operations, and delivery. |
| Threat intelligence gathering (THIN) (Level 6) | Reviews threat intelligence capabilities. Sets direction, plans and leads the organisation's approach for threat intelligence, including use of suppliers. |
| Threat modelling (THIN) (Level 6) | Uses threat intelligence to develop attack trees. |
| Threats and breaches (SCTY) (Level Seven) | Leads the provision of information security resources, expertise, guidance and systems necessary to execute strategic and operational plans across all the organisation's information systems. This includes executive responsibility and accountability for the management of threats to confidentiality, integrity, availability, accountability and relevant compliance, and for security control reviews, business risk assessments and reviews that follow significant breaches of security controls. In the case of breach, undertakes the duties of data protection officer to ensure that registration and notification of the breach is done in accordance with GDPR legislation. |
| Tools and techniques (VURE)(Level Six) | Develops techniques and tools to analyse and expose vulnerabilities designing new vulnerability discovery techniques. |
| Transformation and change (PEMT)(Level 6) | Leads the organisation during times of change, aligning change programmes with the skills and capabilities of key senior staff. Support senior staff, through difficult and challenging change programmes. |
Behavioural Skills
| Title | Details |
|---|---|
| Ambiguity | Comfortable dealing with ambiguity and operating in environments that evolve and change. |
| Analytical Thinking | Acquiring a proper understanding of a problem or situation by breaking it down systematically into its component parts and identifying the relationships between these parts. Selecting the appropriate method/tool to resolve the problem and reflecting critically on the result, so that what is learnt is identified and assimilated. |
| Conceptual Thinking | Acquiring understanding and insights regarding the underlying issues in complex problems or situations through the development of abstract representations, the identification of patterns and the analysis of hypotheses. |
| Decision Making | Making decisions at the appropriate time, taking into account the needs of the situation, priorities, constraints, known risks, and the availability of necessary information and resources. |
| Delegation | Delegating tasks, responsibilities and authorities effectively. |
| Flexibility | Taking account of new information or changed circumstances and/or business requirements and modifying response to a problem or situation accordingly. |
| Follow-up and Monitoring | Checking progress against targets, taking action to resolve exceptions/ issues and reporting and escalating where necessary. |
| Goal Orientation | Maintaining focus on agreed objectives and deliverables. |
| Holistic Thinking | The ability to place problems in the context of the wider business landscape or area of interest. Understanding how different business functions work together to achieve shared goals. |
| Influence, Persuasion and Personal Impact | Conveying a level of confidence and professionalism when engaging with stakeholders, influencing positively and persuading others to take a specific course of action when not in a position of authority. |
| Information Acquisition | Identifying gaps in the available information required to understand a problem or situation and devising a means of resolving them. |
| Interacting with People | Establishing relationships, contributing to an open culture and maintaining contacts with people from a variety of backgrounds and disciplines. Effective, approachable and sensitive communicator in different communities and cultures. Ability to adapt style and approach to meet the needs of different audiences. |
| Leadership | Clearly articulating goals and objectives, and motivating and leading others towards their achievement. |
| Organisational Awareness | Understanding the hierarchy and culture of own, customer, supplier and partner organisations and being able to identify the decision makers and influencers. |
| Providing Direction | Directing others to undertake specified tasks within a defined timescale. |
| Resilience | Demonstrates resilience when working under pressure, displaying a calm and rational approach to the task at hand. |
| Strategic Perspective | Keeping organisational objectives and strategies in mind, and ensuring courses of action are aligned with the strategic context. |
| Strategic Thinking | Long-term, broad vision perspective, situational analysis and pattern identification to anticipate potential outcomes when considering immediate and future implications of actions and decisions. |
Technical Skills
| Title | Details | Depth |
|---|---|---|
| Access Control Systems | Any tool or system which provides security access control (i.e. prevents unauthorised access to systems). | Proficient in |
| Analytical Tools | Analytical, statistical and machine learning tools appropriate to the organisational environment. Able to apply these tools and techniques to meet the requirements of stakeholders. | Proficient in |
| Application Systems | Technical or functional understanding of Commercial Off-the-Shelf (COTS) applications and/or other bespoke software deployed within the organisation in order to provide system configuration, audit, technical, and/or functional support. | Proficient in |
| Big Data | The discipline associated with data sets so large and/or complex that traditional data processing applications are inadequate. The data files may include structured, unstructured and/or semi-structured data, such as unstructured text, audio, video, etc. Challenges include analysis, capture, curation, search, sharing, storage, transfer, manipulation, analysis, visualization and information privacy. | Familiar with |
| Business Continuity Planning | Methods and techniques for risk assessment, business impact analysis, establishment of countermeasures and contingency arrangements relating to the serious disruption of IT services. | Familiar with |
| Business Environment | The business environment relating to own sphere of work (own organisation and/or closely associated organisations, such as customers, suppliers, partners and competitors), in particular those aspects of the business that the specialism is to support (i.e. localised organisational awareness from a technical perspective). | Expert in |
| BYOD | The policy of permitting employees to bring personally owned mobile devices (laptops, tablets, smart phones etc) to their workplace, and the implications of using those devices to access privileged company information and applications consistent with safeguarding corporate systems and data taking account of security and confidentiality requirements. Also called bring your own technology (BYOT), bring your own phone (BYOP), and bring your own PC (BYOPC). | Proficient in |
| Cloud/Virtualisation | The principles and application of cloud/ virtualisation (including ownership, responsibilities and security implications). Use of tools and systems to manage virtualised environments. | Proficient in |
| Corporate, Industry and Professional Standards | Applying relevant standards, practices, codes, and assessment and certification programmes to the specific organisation or business domain. | Expert in |
| Cyber Security Concepts | The understanding of cyber security concepts and ability to effectively translate and accurately communicate security and risk implications across technical and non-technical stakeholders so that they are understood and applied. | Expert in |
| Disaster Recovery Planning | Methods and techniques for planning for, and mitigating against, serious disruption of IT services. Techniques may include data replication, log shipping, HA, resilience, fallback location/services, offsite back-up, recovery time objectives (RTO), recovery point objectives (RPO), maximum tolerable downtime window, cloud computing, diversity, etc. | Familiar with |
| Information Architecture | Methods, techniques and technologies for ingesting, securing, processing and using data and information within and beyond an organisation. | Expert in |
| Infrastructure/System Security | The security threats and vulnerabilities that impact and/or emanate from system hardware, software and other infrastructure components, and relevant strategies, controls and activities to prevent, mitigate, detect and resolve security incidents affecting system hardware, software and other infrastructure components. | Expert in |
| IT Audit | Principles, practices, tools and techniques of IT auditing. | Familiar with |
| IT Environment | The IT environment relating to own sphere of work (own organisation and/or closely associated organisations, such as customers, suppliers, partners), in particular own organisation's technical platforms and those that interface to them through the specialism, including those in closely-related organisations. | Proficient in |
| National/International Standards | Current and emerging standards associated with IT practice nationally and internationally, published by authorities such as IEEE, IEC, BSI, ISO. | Proficient in |
| Network Data Security | Network security and threat mitigation, including physical, electronic, firewalling, encryption, access, and authorisation; protecting data at rest and in transit; defending against viruses and malware; the impact of Big Data; and the integration of robust security controls into enterprise services and policies. | Expert in |
| Network Traffic Analysis | Methods and techniques for the capture of traffic information (packet level) and the forensic analysis of this information into its constituent elements. | Expert in |
| Networking and Communications | The planning and management of the interaction between two or more networking systems, computers or other intelligent devices. | Proficient in |
| Operating Systems | System software that controls activities such as input, output, dynamic resource allocation, and error reporting, within the operation of a computer configuration. | Proficient in |
| Operational/Service Architecture | Knowledge of the IT/IS infrastructure and the IT applications and service processes used within own organisation, including those associated with sustainability and efficiency. | Familiar with |
| Own Organisation's IT Products and Services | The IT products and/or services supplied to internal and external customers by own organisation. | Familiar with |
| Security Software, Tools and Techniques | Specialist tools and techniques used in the pursuit of vulnerability management, penetration testing , digital forensics and other security management disciplines for bug-hunting, abstract interpretation and program analysis, binary analysis and reverse-engineering, exploit development, source code analysis, and static and dynamic application security testing (SAST/DAST) etc. | Expert in |
| Third Party IT Products and Services | The IT products and/or services supplied to own organisation by external suppliers. | Familiar with |
Other Skills
| Title | Details | Depth |
|---|---|---|
| Appraisal Techniques | Methods and techniques for appraising an individual's performance and potential. | Expert in |
| Budgets | Principles, methods, techniques and tools for the preparation and monitoring of budgets to manage costs and ensure cost-effectiveness and value for money. | Proficient in |
| Coaching Techniques | Methods and techniques for coaching individuals or groups by a balanced combination of support and direction, which could include use of virtual learning environments plus add-ons to augment feedback specific to work items, workflow or career plans. | Expert in |
| Data Protection | Principles, practices, tools and techniques to ensure data protection. | Expert in |
| Disciplinary Issues and Procedures | Managing episodes of unsatisfactory behaviour or performance in accordance with appropriate policies and legislative conformance. Includes changes to circumstances, such as sickness, disability and other personal issues. | Proficient in |
| Document Management Techniques | Methods and techniques for the organisation, storage and version control of information in both paper and electronic formats. | Expert in |
| Enterprise Architecture | Understanding of Enterprise Architecture principles and practises, e.g. as defined within TOGAF, used to create a strategic framework to align the organisation's business strategy, processes, information, and technology to satisfy business goals. Enterprise architecture provides a holistic view of the organisation, enabling effective decision-making, optimisation of resources, and more efficient adaptation to change in the business environment. | Familiar with |
| Financial Management | Knowledge of Financial Management and Management Accounting. Competent management of costs, budgets and cash flow. | Proficient in |
| Information Assurance Methods and Tools | Information assurance methods, tools and techniques (including the Caldicott Principles) used to protect the integrity, availability, authenticity, non-repudiation and confidentiality of user data and manage the risks related to the use, processing, storage, and transmission of information. | Expert in |
| Legislation | Relevant national and international legislation. | Expert in |
| Literature Search | Methods, techniques and tools for searching and obtaining relevant knowledge from published literature. | Proficient in |
| Network Data Gathering Techniques | The selection, implementation and application of network data gathering methods, tools and techniques that are appropriate to the information required and the sources available. | Familiar with |
| Performance Monitoring | Identifying, agreeing and monitoring (usually by face-to-face interviews) objectives and deliverables with individuals. Identifying under-performance issues against agreed quality standards and performance criteria. Identifying gaps in capability and causes, disciplinary or ability-related (needing assistance, training or other support). | Expert in |
| Presentation Techniques | Methods and techniques for delivering effective and accessible presentations, either face-to-face or online within various contexts and to a variety of audiences. | Expert in |
| Process Documentation Techniques | Principles, methods and techniques for establishing, documenting and maintaining processes. | Proficient in |
| Project Risk Management | The identification, assessment and management of project risks, that could result in time or cost over-runs, or failure to deliver products which are fit for purpose. | Expert in |
| Report Writing Techniques | Methods and techniques for writing clear, accessible and persuasive reports. | Proficient in |
| Research Techniques | Methods, techniques and tools for the systematic discovery, analysis, and reporting of knowledge about all aspects of information systems. | Expert in |
| Resource Allocation | The effective and efficient routine deployment of resources, (but also including reassessment and reallocation in a dynamic multi-project environment), to achieve optimum results. | Proficient in |
| Risk Management | Methods and techniques for the assessment and management of business risk. | Expert in |
| Stakeholder Engagement | Establishing relationships, analysing perspectives and managing stakeholders from a variety of backgrounds and disciplines. Adapting stakeholder engagement style to meet the needs of different audiences. The identification of key business stakeholders and an assessment of their level of power and interests, and their perspectives to inform the way(s) in which they should be considered and managed. | Proficient in |
| Standards Writing Techniques | Principles, methods and techniques for establishing, documenting, and maintaining standards. | Expert in |
| Team Dynamics | Knowledge and understanding of the psychological and environmental forces that influence the direction of team behavior and performance and the tools and techniques to improve team cohesion and performance. | Familiar with |
| Techniques for Effective Meetings | Methods and techniques for running effective meetings and for understanding and influencing the roles played by participants. | Proficient in |
| Threat Landscape | Knowledge and understanding of the threat landscape, regulatory and legislative requirements and awareness of industry good practice relating to information governance, privacy and security. | Expert in |
Training
| Title | Details |
|---|---|
| Diversity and Inclusion | Raise diversity in-the-workplace awareness in order to better understand how the world looks through the eyes of people of a different age, race, gender, sexuality, etc, improve communications with people from diverse backgrounds and reduce the levels of unconscious bias in decision-making. |
| Human Resource Planning | Techniques and practices involved in planning the numbers and types of personnel needed over time by a particular skillset, department or function within an organisation. |
| Mentoring | Methods and techniques for providing mentoring support to less experienced individuals. |
| Network Infrastructure Architecture | The frameworks and principles on which networks, systems, equipment and resources are based. |
| Service Delivery | The service delivery processes: the systems, products, services, hardware and software environment. |
| Strategic Planning for Information and Communications Systems | The process of defining the ICT strategic plan of an organisation in a methodical way based on business aims and objectives thereby enabling the specification of options and associated action plans for the use of IT-enabled business processes. |
Professional Development Activity (PDA)
| Title | Details | PDA Group |
|---|---|---|
| Gaining Knowledge of Broader IT Issues | Increasing and maintaining currency of knowledge of broader IT issues through reading, attending and participating in seminars or conferences, special studies, temporary assignments etc. | Increasing Knowledge |
| Gaining Strategic Knowledge of Employing Organisation | Developing a comprehensive understanding of the business environment in which the employing organisation operates and its position, policies and direction in relation to health and care, country and global issues. | Increasing Knowledge |
| General Management | Continuing learning and development in general management skills, such as effective communication, leadership styles and skills, team building and team roles, motivation and delegation, planning and resource scheduling, influencing, persuasion and negotiation, so as to be in a position to accept greater responsibility at senior management or director (including non-exec) level. | Developing Professional Skills |
| Mentoring | Acting as a mentor, advising those for whom there is no direct responsibility, on matters to do with their job role, career and professional development. | Broadening Activities |
| Participation in Professional Body Affairs | Taking an active part in professional body affairs at branch, specialist group, committee or board level. | Participation in Professional Activities |
Qualification Components
| Title | Awarding Bodies |
|---|---|
| BCS Practitioner Certificate in Information Risk Management | BCS The Chartered Institute for IT |
| CGEIT Certified in the Governance of Enterprise IT | ISACA |
| Chartered Cyber Security Professional (ChCSP) | The UK Cyber Security Council |
| CISA Certified Information Systems Auditor | ISACA |
| CISM Certified Information Security Manager | ISACA |
| CISSP Certified Information Systems Security Professional | (ISC)2 International Information Systems Security Certification Consortium |
| FEDIP Leading Practitioner | The Federation for Informatics Professionals |
The Professional Body Responsible for this job family is BCS. This job role profile was created in collaboration with BCS, using Role Model Plus.