Head of Vulnerability Management

Job summary

Please note this role requires DV Clearance

The Government Cyber Unit's mission is to protect public services from cyber threats and digital resilience failures. We are working to achieve a step change in our cyber and digital resilience across government, through delivery of the Government Cyber Action Plan, and working closely with departments and national technical authorities including the National Cyber Security Centre to deliver. This is a challenging time to be working in cyber security and digital resilience, but we have an incredible opportunity to make a difference to people’s lives and promote national security by protecting the public services and national infrastructure they rely on. We work at the forefront of shaping the UK’s national response to emerging cyber and technology issues - from the increasingly complex range of state-sponsored cyber-attacks and supply chain compromises, through to the transformational benefits and security challenges of frontier AI and quantum computing.

We are committed to creating an inclusive and supportive working environment where people can learn, develop and do their best work. Continuous professional development and a focus on wellbeing is core to our unit culture. We welcome applications from candidates who share this ethos and are excited by our mission.

The Government Cyber Coordination Centre (GC3) coordinates the cross-Government response to cyber security vulnerabilities, threats, and incidents, and enables cyber defenders across Government to work together and to “defend as one”. The GC3 is a joint initiative sponsored by the Department for Science, Innovation and Technology (DSIT) and the National Cyber Security Centre (NCSC). This role is based in DSIT, but you should expect to work closely alongside colleagues from both sponsoring organisations, and wider Government and the public sector.

Job description

Please Note - Former DSIT recruitment campaigns are continuing as usual, but candidates should be aware that following the Government’s announcement on the changes to some civil service departments, roles will be subject to the machinery of government moves and will ultimately be in one of the new departments. We will provide more information if you are selected for a role. This work remains of high importance to the civil service, and we thank you for your continued interest.

We are looking for an experienced vulnerability management professional to set the strategic direction for vulnerability management across government and coordinate action to reduce cyber risk through the effective identification, mitigation and remediation of vulnerabilities. This role reports to the Deputy Director for Government Cyber Operations.

Responsibilities

• set the strategic direction for vulnerability management across government, leading the government’s approach to identifying, triaging, mitigating, and remediating vulnerabilities across departments
• work closely with the Government Cyber Unit’s accountability team to establish and operate governance, policy, assurance and risk/performance reporting structures for vulnerability management across government
• understand and report on government’s aggregate exposure to vulnerabilities, and performance remediating or otherwise mitigating vulnerabilities
• lead the operation of central vulnerability management services, including the Vulnerability Reporting Service (VRS) and Vulnerability Monitoring Service (VMS), ensuring delivery of a quality service that efficiently and effectively reduces risk at-scale, and driving continuous improvement
• work closely with the Government Cyber Unit’s Services team to build and continually improve central vulnerability management services, providing SME input and direction for the product roadmap
• work closely with the GC3 Incident Management function to support the cross-government response to critical vulnerabilities, enabling a rapid understanding of risk, clear communications to decision makers, and a coordinated and informed response across government
• support teams across DSIT and the NCSC working to reduce vulnerabilities at source, both through improving underlying technology and reducing the attack surface
• advise ministers, senior officials, and IT and cyber security leadership across government on the risk from vulnerabilities, and the operational response to these
• engage closely with stakeholders and customers across government, including wider DSIT, the NCSC, and departmental IT and cyber security teams
• line manage lead analysts in the vulnerability management team, and provide coaching and support to staff across the GC3

The post holder may be required to support out of hours on call rotas for responding to cyber and digital resilience incidents, for which remuneration and/or flexible working arrangements will be available.

Person specification

We’re looking for someone with:

• significant experience leading vulnerability management in a large, complex organisation, and a deep understanding of vulnerabilities and vulnerability management practices
• strong leadership skills, with the ability to set strategic direction, lead cross-functional teams, and lead delivery in a complex environment
• strong stakeholder engagement and influencing skills, with the ability to build trusted relationships, manage competing priorities, and achieve consensus
• the ability to provide clear and highly credible advice to senior decision makers, including translating complex vulnerability information for a non-technical audience
• the ability to balance strategic objectives, operational risks, and competing stakeholder requirements

Benefits

There are many benefits of working at DSIT, including:

• flexible hybrid working with flexi-time and the option to work part-time or condensed hours
• a Civil Service Pension with an average employer contribution of 28.97%
• 25 days of annual leave, increasing by a day each year up to a maximum of 30 days
• an extra day off for the King’s birthday
• an in-year bonus scheme to recognise high performance
• career progression and coaching, including a training budget for personal development
• a focus on wellbeing with access to an employee assistance programme
• job satisfaction from making government services easier to use and more inclusive for people across the UK
• advances on pay, including for travel season tickets
• death in service benefits
• cycle to work scheme and facilities
• access to an employee discounts scheme
• 10 learning days per year
• volunteering opportunities (5 special leave days per year)
• access to a suite of learning activities through Civil Service learning

Any move to Government Digital Service from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility at https://www.childcarechoices.gov.uk

Office attendance
The Department operates a discretionary hybrid working policy, which provides for a combination of working hours from your place of work and from your home in the UK. The current expectation for this role is 60% office attendance.
DSIT does not normally offer full home working (i.e. working at home); but we do offer a variety of flexible working options (including o