Principal Cyber Security Analyst

Are you ready to take the lead in securing cloud environments for a vital public service Join us as a Principal Cyber Security Analyst within the Digital Risk & Security branch of our Chief Digital Office where your expertise will guide our commitment to protecting Social Security Scotland. If you are passionate about cloud security and have a keen interest in safeguarding critical information systems apply now to join our talented team and take the next step in your career.

As the Principal Cyber Security Analyst you will play a pivotal role in providing technical leadership across our security tooling within our cloud environment. Collaborating closely with cloud engineers and architects you will oversee the development and implementation of robust cloud security architectures ensuring compliance with industry best practices across multicloud landscapes. This is a key technical leadership position within Digital Risk & Security focusing on applying proportional security measures to underpin our digital strategy.

Social Security Scotland an Executive Agency of the Scottish Government is undertaking the largest and most complex IT and digital change programme since devolution. With a lifetime budget of over 300m Social Security Scotland is delivering a social security system that will support the people of Scotland for decades to come.

We aim to develop within Social Security Scotland a positive and inclusive culture which supports our people to flourish by embedding a working environment where we all treat each other with dignity and respect and recognise each others contributions.

Principal Cyber Security Analysts are responsible for protecting the confidentiality integrity and availability of information and information systems used by government and Partners Across Government.

At this role level you will:

• Initiate and influence relationships with and between key stakeholders in taking forward all aspects of cyber security acting as a primary point of contact for senior stakeholders and influencers.
• Manage the assessment and response to cyber threats to maintain confidentiality integrity availability accountability and relevant compliance.
• Operate as a focus for cyber security expertise for the organisation and the wider central government community providing authoritative advice and guidance on the application and operation of all types of cyber security controls.
• Oversee the work of the cyber security function including project and task definition and prioritisation quality management and budgetary control and management tasks such as recruitment and training.

Responsibilities

• Stakeholder Engagement: Initiate and cultivate relationships with key stakeholders serving as the primary point of contact for all aspects of cyber security ensuring comprehensive communication and collaboration.
• Security Control Development: Develop and enforce security controls within Infrastructure as Code (IaC) pipelines such as Terraform and AWS CloudFormation ensuring securebydesign deployments. Embed security into CI/CD pipelines integrating security testing (SAST DAST SCA) and automated compliance checks to enhance security without hindering development velocity.
• Cloud Security Monitoring: Lead initiatives to monitor assess and enhance our cloud security posture leveraging automation to detect and remediate and operationalise cloudnative security monitoring solutions integrating SIEM SOAR and threat intelligence to enhance detection and response capabilities.
• Cyber Security Expertise: Act as a focal point for cyber security expertise offering authoritative advice and guidance on the application and operation of various cyber security controls across the organisation and the wider central government community.
• Incident Management:Champion policies and processes for incident management investigation and response. Proactively manage the assessment and response to cyber threats ensuring the confidentiality integrity and availability of our information systems.
• Strategic Delivery: Deliver specific pieces of work resulting from the Cyber Security Strategy related to cyber business and embed cloud security tooling capabilities to enable our digital roadmap.
• Risk Assessment and Management: Deliver comprehensive risk assessments for complex scenarios integrating insights into the broader risk management process and aligning risk considerations with corporate governance frameworks.
• Policy Development: Develop cyber security policies standards and guidelines that reflect business technological and legal requirements adhering to best practices and industry standards.