EPRR Business Continuity Specialist (Cyber Focus)

Job description

Detailed job description and main responsibilities

Cyber Resilience and Business Continuity

The post holder will lead the development, implementation and maintenance of the Trust's Cyber-Attack Business Continuity Plan, ensuring alignment with NHS England EPRR standards, NCSC guidance, Data Security and Protection Toolkit (DSPT) requirements, and organisational resilience objectives.

The post holder will work collaboratively with Clinical Management Groups (CMGs), Corporate Directorates, Digital & Data Services and key stakeholders to ensure appropriate arrangements are in place to maintain critical services during cyber incidents, digital outages and loss of key systems.

Business Impact Assessment and Digital Dependency Mapping

The post holder will facilitate and support Business Impact Assessments across clinical and corporate services to identify critical activities, recovery priorities, key dependencies and acceptable downtime periods.

They will maintain an understanding of the Trust's critical digital systems and associated operational dependencies, ensuring continuity arrangements are proportionate to identified risks and vulnerabilities.

The post holder will support the EPRR Team ensure the Trust has in place an ambitious EPRR Work Programme with the aim of ensuring continued improvement and establishing best practice within EPRR.

Assurance, Governance and Compliance

The post holder will support the provision of assurance regarding business continuity and cyber resilience arrangements through the monitoring, review and reporting of compliance with relevant legislation, national guidance and Trust policies.

The post holder will prepare reports, briefings and assurance documentation for committees, senior managers and other governance groups as required.

The post holder will support the EPRR Team in the development of robust plans which in turn, will support the Trust and its stakeholders to respond to incidents and emergencies.

Service and CMG Support

The post holder will work closely with CMGs and Corporate Directorates to develop, review and maintain local business continuity plans, ensuring that services are prepared to respond effectively to the loss of critical digital systems and other major disruptions.

They will provide specialist advice and guidance to managers and service leads on continuity planning, resilience improvement and recovery arrangements.

Working with Digital and Cyber Teams

The post holder will establish strong working relationships with Digital & Data Services, Information Governance and Cyber Security colleagues to ensure continuity and recovery arrangements are aligned with technical disaster recovery and cyber incident management plans.

The post holder will support the review and development of recovery strategies, recovery priorities and system restoration arrangements for critical Trust services.

Learning and Continuous Improvement

The post holder will contribute to the identification, capture and implementation of lessons identified from incidents, exercises, audits and assurance reviews, ensuring that improvements are embedded into plans, policies, procedures and training programmes.

Policy

The post holder will support with the ongoing development, review, and implementation of the Trust's Business Continuity Management Policy. This should ensure the relevant requirements of NHS England's core standards for EPRR and ISO:22301 are implemented across the organisation as required.

Support UHL Response to Incidents

The post holder will provide support and advice during incidents to the Trust's incident coordination teams.

Professional Relationships

The post holder may need to represent the Trust and promote UHL and the EPRR

Teams' interests in multi-agency meetings. This may include disseminating relevant information as well as developing and maintaining effective working relationships with stakeholders.

Information

The post holder will deal with sensitive and confidential material from both within the Trust and other Category 1 and 2 responders.

Personal Development

The post holder will be responsible for undertaking personal development and training to enhance skills and expertise and to maintain up-to-date knowledge of legislation and policies relating to all aspects of EPRR, including business continuity.

Please see job description/person specification for full details on the role.

Person specification

Training and Qualifications

Essential criteria

• Degree, NVQ level 4 in relevant subject or equivalent level qualification or significant experience of working at a similar level in the specialist area.
• Evidence of continuing professional development in EPRR, Business Continuity, Organisational Resilience, Cyber Resilience or related field.

Desirable criteria

• Diploma in Health Emergency Planning (DipHEP).
• Qualification in project management or management studies.
• Cyber resilience, cyber incident management or information governance training.
• Experience of working in specialist area for a minimum of 9 months.

Knowledge

Essential criteria

• Knowledge and understanding of emergency planning legislation, including the Civil Contingencies Act 2004.
• Knowledge and understanding of emergency planning methodologies, incident management structures, command and control arrangements, and major incident response.
• Knowledge of cyber resilience principles and the operational impacts of cyber incidents on healthcare delivery.
• Knowledge and understanding of Cyber Resilience and Cyber Incident Management
• Experience of managing risks and reporting.

Desirable criteria

• Knowledge of Data Security and Protection Toolkit (DSPT) requirements.
• Knowledge of NHS digital systems and their role in clinical service delivery.
• Understanding of recovery time objectives, recovery priorities and critical service dependencies.

Experience

Essential criteria

• Proven experience of writing reports.
• Experience of presenting complex information to a variety of people with different levels of understanding of presented topic.
• Ability to analyse complex issues where material may be conflicting and drawn from multiple sources.
• Experience of developing and implementing organisational resilience or business continuity improvement programmes.
• Experience of undertaking Business Impact Assessments and identifying critical service dependencies.
• Demonstrated capability to act upon incomplete information, using experience or critical thinking to make inferences and decision making.
• Demonstrated capability to manage own workload, to plan over short, medium and long- term and adjust plans and resource requirements accordingly.

Desirable criteria

• Experience working in the NHS or Public Sector.
• Experience of mapping digital system dependencies across complex organisations.
• Experience of developing, implementing and reviewing business continuity and emergency preparedness plans, including arrangements for cyber-related disruptions, in line with NHS England, NCSC and local organisational requirements.
• Experience of designing, delivering and evaluating exercises and simulations to test emergency preparedness, business continuity and cyber resilience arrangements, including identifying lessons learned and supporting continuous improvement.

Communication and Relationship Skills

Essential criteria

• Ability to work independently and as part of a team.
• Ability to engage, influence and gain commitment from senior clinical, operational and corporate stakeholders.
• Excellent interpersonal communication skills at all levels.
• Ability to establish and maintain good working relationships with people from a wide variety of personal and professional backgrounds.
• You actively encourage and provide opportunities for others to share ideas and contributions.
• Values diversity and difference, operates with integrity and openness.
• Ability to communicate in a professional manner confidently and effectively both verbally and in written format.
• Ability to persuade and influence decision making.

Desirable criteria

• Ability to communicate confidently with people at all levels of seniority.
• Ability to diffuse challenging situations.

Analytical and Judgement Skills

Essential criteria

• Commitment to and focused on quality, promotes high standards in all they do.
• Ability to analyse complex organisational interdependencies and prioritise recovery requirements.
• Consistently looks to improve what they do, looks for successful tried and tested ways of working, and seeks out innovation.
• Actively develops themselves and supports others to do the same.
• Evidence of continued professional development.
• Ability to think critically, prioritise, and recommend appropriate action through the assessment of relevant information.
• Ability to assess the impact of digital system failures on operational and clinical services and identify appropriate continuity measures.
• Ability to problem solve and has attention to detail.

Desirable criteria

• Able to make a connection between their work and the benefit to patients and the public.

Planning and Organisational Skills

Essential criteria

• Highly competent computing skills, including Microsoft Word, Excel and PowerPoint.
• Experience of leading complex work programmes involving multiple stakeholders and competing priorities.
• Highly motivated and able to plan and manage projects to deadlines.
• Able to influence and negotiate others to encourage collaborative working and achieve desired outcomes.
• Excellent organisational, programme, resource and time management skills.

Equality, Diversity and Inclusion

Essential criteria

• An understanding of and commitment to equality of opportunity and good working relationships, both in terms of day to-day working practices, and in relation to management systems.
• Ability to treat all individuals with dignity and respect.

Other requirements specific to the role

Essential criteria

• Ability to operate at Official Sensitive level.
• Ability to think ahead to anticipate, identify and address any risks or problems before they occur.
• Able to work for long periods at a desk using a computer workstation.
• Ability to travel between Trust sites and attend regional resilience meetings.

Desirable criteria

• Experience of working in an emergency situation.

Commitment to Trust Values and Behaviours

Essential criteria

• Must be able to demonstrate behaviours consistent with the Trust's Values and Behaviours

Additional Information

Please submit your application form without delay to avoid disappointment; we will close vacancies prior to the publishing closing date if we receive a sufficient number of completed application forms.

Please check the email account (including your junk mail) that you supplied as part of your application on a regular basis following the closing date and throughout the recruitment process, as this is how we will communicate with you.

UHL is an equal opportunities employer. We aim to employ a workforce that reflects the diverse communities we serve. We welcome applications from people from all backgrounds who match our job criteria.

Applicants who have a disability and meet the essential criteria for the job will be interviewed if you indicate you wish to be considered under the Guaranteed Interview Scheme. If you require a reasonable adjustment at any stage of the recruitment process please make the recruitment services team aware as soon as possible.

UHL is committed to helping colleagues balance the demands of both their work and personal needs through flexible working arrangements wherever reasonably practicable and subject to service needs.

Disclosure and Barring Service Check

Please note if you are successful in obtaining this position and the post involves regulated activity you will be required to undertake a Disclosure & Barring Service check.

The Trust will pay for the check initially and the money will then be deducted from your salary over a three month period commencing on your first month's payment.

The current price of a check is £38 for an enhanced and £18 for a standard check.

COVID 19 Risk Assessment

Due to the current Covid pandemic we have introduced a staff risk assessment into our pre-employment process. This now forms part of the mandatory pre-employment checks that will be carried out if you receive a conditional offer.

The risk assessment is intended to ensure you are able to safely perform your duties in any of our work areas, and if you have been identified as being particularly vulnerable to coronavirus. Our main aim is to reduce risk and to ensure the safety of all new starters to the Trust as well as current staff, patients and visitors.

If it is identified that you are within a vulnerable category, we will endeavor to make reasonable adjustments to accommodate this through discussions with both Occupational Health and your recruiting manager.

Covid Vaccination Status

Covid-19 vaccination remains the best way to protect yourself, family, colleagues and our patients/service users from the Covid-19 virus. We therefore continue to encourage our current and potential colleagues to get vaccinated.

University Hospitals of Leicester NHS Trust holds the principles of equality, diversity and inclusion at the heart of everything it does and all that it stands for. We are committed to developing a workforce that is representative of the community we serve. We welcome applications from the diverse community of Leicester, Leicester and Rutland, to help deliver healthcare services that meets the needs of our diverse communities.

Employer certification / accreditation badges