Cyber Security Assurance Specialist (DSPT / CAF)

The Opportunity:

Our consultancy client is partnered with a major UK Government Agency and are seeking an experienced DSPT & Cyber Assessment Framework (CAF) Assurance Specialist to provide specialist assurance across a significant data security and cyber resilience programme. The organisation is currently undertaking a programme focused on compliance with the Data Security and Protection Toolkit (DSPT) and the NCSC Cyber Assessment Framework (CAF). The programme is developing proposals, controls and actions to address identified gaps.

The requirement now is for an experienced assurance professional who can independently assess whether those proposals and actions are appropriate, effective and delivering the intended improvement in organisational maturity; providing an evidence-based view of the current state, assess the effectiveness of remediation activity, identify remaining gaps and help ensure that improvement plans translate into sustainable security and data protection outcomes.

You'll be a credible assurance professional comfortable with reviewing evidence, challenging proposed solutions and determining whether controls are actually operating effectively; equally comfortable discussing cyber risk with technical specialists and presenting clear, concise assurance findings to senior programme and organisational stakeholders.

Previous experience of DSPT and CAF within NHS, healthcare or Government environments is highly desirable.

Skills and Experience:

Essential

* Significant professional experience in cyber security, information assurance, security governance, risk or compliance, with demonstrable experience assessing organisational maturity against security or data protection frameworks.

* Practical experience working with the Data Security and Protection Toolkit (DSPT) and working with the NCSC Cyber Assessment Framework (CAF).

* Experience undertaking assurance, audit, assessment or independent review activity within NHS, healthcare, Government or another highly regulated environment, reviewing evidence and determining whether controls and remediation activity are genuinely effective.

* Strong understanding of cyber security governance, risk management and control frameworks.

* Ability to translate framework requirements into practical assurance questions, evidence requirements and measurable outcomes, with strong analytical skills and the ability to identify gaps, risks, weaknesses and dependencies.

* Excellent stakeholder management skills, including the confidence to challenge senior stakeholders constructively, producing clear assurance reports, recommendations, action plans and executive-level briefings.

Desirable

* Experience working within the NHS, DHSC, UK Government or Government Arm's Length Bodies.

* Previous experience acting as an independent DSPT assessor or assurance provider.

* Experience with CAF-aligned DSPT assessments.

* Knowledge of NHS information governance and data protection requirements.

* Experience with ISO 27001, NIST, Cyber Essentials / Cyber Essentials Plus or similar security frameworks.

* Experience with risk and control frameworks, audit methodologies or maturity models.

* Experience supporting cyber transformation, remediation or organisational improvement programmes.

Role and Responsibilities:

* Provide independent assurance across DSPT and CAF-related activities, proposals and remediation plans.

* Assess the organisation's current maturity against relevant DSPT and CAF requirements.

* Review existing assessments, evidence, controls, improvement plans and supporting documentation.

* Evaluate whether proposed actions are appropriately designed to address identified risks and gaps.

* Assess whether completed actions and controls are operating effectively and producing the intended outcomes.

* Identify weaknesses, residual risks, dependencies and areas requiring further remediation.

* Provide clear, evidence-based assurance findings and recommendations to senior stakeholders.

* Challenge assumptions and proposed approaches where evidence does not demonstrate sufficient assurance.

* Support the development and maintenance of maturity assessments, assurance plans, action plans and evidence repositories.

* Map findings and recommendations against relevant DSPT and CAF outcomes, principles and indicators of good practice.

* Work closely with Cyber Security, Information Governance, Data Protection, Risk, Compliance and Programme teams.

* Support the establishment of appropriate measures and evidence to demonstrate sustainable improvement.

* Contribute to governance forums, assurance reviews and senior-level reporting.

* Help ensure that improvements are embedded into business-as-usual processes rather than treated solely as point-in-time compliance activity.

NB: The successful candidate will be required to undergo a basic level of security clearance before undertaking the assignment (one to two weeks’ lead-time).

Applications:

To learn more about this newly created opportunity consulting as a Cyber Security Assurance and Maturity Lead Consultant for an initial 6-month temporary engagement, operating on a remote-working basis; please call and speak with Edward Laing here at ISR Recruitment or please send through a copy of your latest online profile and/or CV for an immediate call back in the strictest confidence.

If you have substantial hands-on experience in DSPT and CAF Assurance and can provide an independent view of organisational maturity, control effectiveness and remediation progress; please contact Edward here at ISR to learn more about our client and how they are leading the way in developing the next generation of technical solutions through innovation and transformational technology?
Only candidates based in UK and eligible to work in UK are allowed