Chief Information Security Officer

Job description

Job summary

Ofgem works on behalf of energy consumers to ensure that every household and business in the UK can rely on a safe, affordable and environmentally sustainable energy supply. We are playing a vital part in accelerating the transition to Net Zero and a carbon neutral energy system. You will be playing your part in creating new energy solutions that are vital for customers, and vital for the environment.

This CISO sits at the heart of Ofgems Security, Privacy and Resilience function within DDSS, with responsibility for leading the organisations cyber and information security strategy, strengthening resilience, and ensuring security enables rather than inhibits delivery. It is a high-impact leadership role requiring clear judgement, pragmatism and the ability to build trusted relationships across the organisation and with external partners.

Team context

The CISO is a strategic leadership role at the heart of Ofgems security, privacy and resilience agenda. Reporting into the CDIO, you will lead the organisations cyber and information security capability, setting the direction for a function that enables the business to operate safely, securely and with confidence.

Overview of the role

As Chief Information Security Officer, you will create the environment and culture that ensures Ofgem can deliver services in a safe and secure way. You will lead the development and delivery of the information and cyber security strategy, shape the organisations security maturity, and ensure risk is managed in a balanced and proportionate way.

You will be accountable for building trust with colleagues and stakeholders, re-establishing confidence in the security function and helping create a positive cultural shift across the organisation. This is an opportunity to lead with influence, bring people with you, and be a true enabler for Ofgem.

Job description

You will be responsible for:

• Leading and driving change. You will go beyond traditional governance and assurance to take ownership from strategy through to delivery, turning priorities into action and driving change through to successful implementation and measurable impact.

• Bringing pragmatism, clarity and energy to complex security challenges, you will work closely with senior stakeholders to understand business priorities, find practical routes to yes, and position security as an enabler of delivery, innovation and great user experience.

• Developing and maintaining Ofgems Cyber strategy, associated risk register and forward work plan, addressing risks to business operations and corporate functions.

• Enabling leaders and all staff to be routinely briefed on strategic and tactical threats to Ofgems security, privacy and resilience, and develop mitigating actions consistent with Ofgems risk appetite.

• Managing Cyber assurance, data protection, security operations and response capabilities, including Incident Management on Data, leak investigations and independent investigation activity with Cabinet Office.

• Acting as a security and privacy professional, championing best practice and embedding Ofgems security, privacy and resilience culture within Ofgem, third parties and business partners; publish associated guidance, practices, tools, standards and templates.

• Overseeing delivery of the Cyber Assessment Framework (CAF) and Departmental Security Health Check (DSHC), working with Cabinet Office and DESNZ.

• Contributing to Directorate and Ofgem strategic programmes; partner with senior leadership to prioritise work and resources, and represent Ofgem across Government and the Energy Sector.

• Setting the strategic direction of the function and provide intellectual leadership, including strategic workforce planning; act as the SME and deputise for the Head of Cyber Security Profession, including Professional Development Lead duties.

• Detecting and analyse relevant trends; advise on implications of new technologies and uses of data; support innovation; determine security investment priorities and create a security roadmap that enables Ofgem to achieve its objectives.

You will need:

• Direct experience in leading Cyber Security, including ongoing definition and delivery of a robust security and privacy strategy, which incorporates intelligence management; threat and risk analysis; risk mitigation; business continuity preparations; and incident detection, response and recovery.

• Substantial experience in a combination of business and risk management, information security, IT services and operational security positions.

• Knowledge across relevant information security and privacy management frameworks and legislation, such as NIST, the NIS Regulations 2018, ISO/IEC 27001, ITIL, COBIT, Data Protection Act 2018 (GDPR).

• Proven experience of working with strategic vendors and partners to deliver high impact and fit-for-purpose results

• An engaging, adaptable, collaborative leadership style with experience of that fosters and supports diversity and inclusion with evidence of operating flexibly in an inclusive manner that engenders diversity in teams.

• Excellent communication skills, both verbal and written with the ability to enthuse stakeholders and colleagues, encouraging them to embrace change.

• Able to obtain and maintain DV clearance.

• Holds Qualifications in, LRD512: Security Leadership Essentials for Managers, BCS Certificate in Information Security Management Principles, GIAC Information Security Fundamentals

• Holds Accreditation in Chartered Qualification

This is a significant opportunity to shape how Ofgem approaches security, privacy and resilience at a time of increasing complexity and importance. We are looking for someone who combines deep expertise with strong judgement, commercial awareness and the ability to lead positively, someone who can build trust, enable delivery and help the organisation move forward with confidence.

Person specification

Essential Criteria

• Direct experience in leading Cyber Security, including ongoing definition and delivery of a robust security and privacy strategy, which incorporates intelligence management; threat and risk analysis; risk mitigation; business continuity preparations; and incident detection, response and recovery. (Lead Criteria)
• Substantial experience in a combination of business and risk management, information security, IT services and operational security positions. (Lead Criteria)
• Knowledge across relevant information security and privacy management frameworks and legislation, such as NIST, the NIS Regulations 2018, ISO/IEC 27001, ITIL, COBIT, Data Protection Act 2018 (GDPR).
• Proven experience of working with strategic vendors and partners to deliver high impact and fit-for-purpose results.
• An engaging, adaptable, collaborative leadership style with experience of that fosters and supports diversity and inclusion with evidence of operating flexibly in an inclusive manner that engenders diversity in teams.
• Excellent communication skills, both verbal and written with the ability to enthuse stakeholders and colleagues, encouraging them to embrace change.
• Able to obtain and maintain DV clearance.
• Holds Qualifications in, LRD512: Security Leadership Essentials for Managers, BCS Certificate in Information Security Management Principles, GIAC Information Security Fundamentals.
• Holds Accreditation in Chartered Qualification.

Desirable Criteria

• Experience in working in the regulated sector.

#LI-DNI

Behaviours

We'll assess you against these behaviours during the selection process:

• Communicating and Influencing
• Leadership
• Managing a Quality Service

Technical skills

We'll assess you against these technical skills during the selection process:

• You will be asked to conduct a presentation during your interview. Details of the presentation will be included in the invitation to interview.

Benefits

Alongside your salary of 81,000, OFGEM contributes 23,465 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).

Ofgem can offer you a comprehensive and competitive benefits package which includes; SCS1 holiday entitlement; Excellent training and development opportunities; The opportunity to join the generous Civil Service pension which also includes a valuable range of benefits; hybrid working (currently 1 day a week in the office but this is kept under review), flexible working hours and family friendly policies. Plus, lots of other benefits including clean and bright offices based centrally, engaged networks and teams and an opportunity to contribute to our ambitious and important targets of establishing a Net Zero energy system by 2050. This exciting blend of professional challenge and personal reward identifies career opportunities at Ofgem as something to get excited about.

Things you need to know

Artificial intelligence
Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window) , and will assess your Behaviours, Experience and Technical skills.

As part of your application, you will be asked to upload a 2-page copy of your CV and provide a 1250 word personal statement evidencing how you meet the essential and desirable skills and capabilities listed in the role profile. Please ensure you demonstrate clearly, within your supporting statement, how you meet each of the criteria listed in the role profile. In the event of receiving a large number of applications, an initial sift may take place on just the lead criteria indicated in the essential criteria.

The personal information we have collected from you will be shared with Cifas who will use it to prevent fraud, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct. If any of these are detected, you could be refused certain services or employment. Your personal information will also be used to verify your identity. Further details of how your information will be used by us and Cifas, and your data protection rights, can be found by [ https://www.cifas.org.uk/fpn ].

At Ofgem, we expect our staff to carry out their roles with honesty, fairness and openness. They should follow the Civil Service code and be free from any influence or bias. We are committed to making sure interests are recognised, declared and managed appropriately so that we can fulfil our duties as an energy regulator. Our Conflicts of Interest policy outlines the types of interests Ofgem staff must declare before onboarding, and the rules they must follow throughout employment so that we can clearly demonstrate that our decisions are not influenced by private interests.

Feedback will only be provided if you attend an interview or assessment.

This role has a minimum assignment duration of 3 years. An assignment duration is the period of time a Senior Civil Servant is expected to remain in the same post to enable them to deliver on the agreed key business outcomes. The assignment duration also supports your career through building your depth of expertise.

As part of accepting this role you will be agreeing to the expected assignment duration set out above. This will not result in a contractual change to your terms and conditions. Please note this is an expectation only, it is not something which is written into your terms and conditions or indeed which the employing organisation or you are bound by. It will depend on your personal circumstances at a particular time and business needs, for example, would not preclude any absence like family friendly leave. It is nonetheless an important expectation, which is why we ask you to confirm you agree to the assignment duration set out above.

Security

Successful candidates must undergo a basic (or equivalent) criminal record check.

Successful candidates must meet the security requirements before they can be appointed. The level of security needed is developed vetting (opens in a new window) .

See our vetting charter (opens in a new window) .

People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window) .

The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion
The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window) .

Apply and further information

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.

The Civil Service welcomes applications from people who have recently left prison or have an unspent conviction. Read more about prison leaver recruitment (opens in new window) .

Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants
Job contact :

• Name : Mercedes Sargant
• Email : [email protected]

Recruitment team

• Email : [email protected]

Further information

Appointment to the Civil Service is governed by the Civil Service Commissions Recruitment Principles. You have the right to complain if you feel there has been a breach of these Recruitment Principles. In the first instance, you should raise the matter directly via [email protected]. If you are not satisfied with the response, you may bring your complaint to the Commission. For further information on bringing a complaint to the Civil Service Commission, please visit their website.

Follow link to apply
[email protected]

Attachments DDSS Role Profile Chief Information Security Officer Opens in new window (pdf, 165kB) CISO Candidate Pack Final copy (1) Opens in new window (pdf, 4363kB)