Cyber Insider Threat Lead

Main Purpose of Job 

The successful candidate will lead a core team in Cyber Services; one of three functions that report to the Chief Information Security Officer (CISO). This is a key area with increasing scope and will be expanding to meet demand. 

Cyber Services has three main areas of responsibility: 

• Cyber Security Policy 
• Cyber Security Education and Awareness 
• Cyber Insider Threat 

This is an opportunity to influence and mature all three areas and would suit someone with a wide-ranging interest within the cyber security profession. The role requires strategic vision and a strong ability to communicate with stakeholders and drive forward positive change.  The mission of this team is to increase the cyber security of the FCDO by determining what users can and cannot do; by educating staff on necessary behaviours and awareness of threats; and by detecting when behaviour falls short. 

Roles and Responsibilities 

The successful candidate will:  

• Assess, benchmark and document the current state of cyber insider threat identification and detection. 

• Develop and validate a collaborative vision for a desired-state of a cyber insider threat life cycle, aligned to the strategic security objectives of the organisation. 

• Create and implement a roadmap for development, utilising existing resources and directing specialist project assistance. 

• Provide reporting and analysis to support risk and policy decision-making, including significant stakeholder engagement and consultation. 

• Contribute specialist knowledge to relevant work streams for a programme of development to improve the security maturity and capability of the organisation. 

• Lead and advocate for Cyber Insider Threat and Cyber Services, internally and externally, including deputising for the Head of Cyber Services when required. 

• Recruit, manage and develop two specialist staff to deliver both existing current-state and future desired-state activities. 

There may be an option to travel, as the team has responsibilities for worldwide cyber security training and local engagement with the FCDO’s overseas network.  However, travel is not a requirement of the role.  

As part of the role, you will be expected to undertake cyber and risk management training to further your skills and development in line with the Government Security Profession career framework. 

You must be a British Citizen at the time of application and, if invited to interview, you will need to bring proof of identity (British Passport/Driving Licence etc.) with you. 

This role requires you to attain Developed Vetting (DV) security clearance. 

For more information about this process, click here. Attaining DV will require you to have been resident in the UK for five of the last ten years. At least one year of this must have been a consecutive twelve-month period. Serving overseas with HM Forces, in some other official capacity as a representative of His Majesty’s Government, or having lived overseas as a result of your parents’ or partner’s Government employment counts as UK residency for the purposes of security clearances. 

It is essential in your application that you provide evidence and proven examples in each of the following Minimum Criteria, Behaviours, and Technical skills as far as you are able to do so.  These responses will be further developed and discussed with those candidates invited for interview. 

Minimum Criteria 

• Background and experience of working in cyber security operations, such as in a security operations centre, cyber threat intelligence, or detections engineering. 

• Excellent written and verbal communication skills including the ability to explain technical details in an accessible manner. 

• Stakeholder management and negotiation, including the ability to justify decisions in the face of challenge.  

• Ongoing professional development including experience of applying training and best practice to deliver improvements. 

• Workflow management, including improvement of collaborative processes, and prioritisation of conflicting demands and timeframes. 

We’ll assess you against these behaviours during the selection process:

• Changing and Improving
• Making Effective Decisions
• Communicating and Influencing
• Delivering at Pace

We only ask for evidence of these behaviours on your application form:

• Changing and Improving
• Making Effective Decisions

We’ll assess you against these technical skills during the selection process:

• Applied Security Capability – Practitioner
• Threat Understanding – Practitioner
• Protective Security – Practitioner
• Risk Assessment and Mitigation – Working
• Information Risk Assessment and Risk Management – Working
• Motivation Question

We only ask for evidence of these technical skills on your application form:

• Applied Security Capability – Practitioner

• A Civil Service Pension.
• 25 days Annual Leave per annum.
• 9 days Public and Privilege holidays per annum.
• Learning and Development tailored to your role. 

Please see the attached Candidate Pack.

Job contact :

• Name : Gavin Watt
• Email : Gavin.Watt@fcdo.gov.uk

Recruitment team

• Email : CSC.Recruitment@fcdo.gov.uk