Job summary
Cyber Operations purpose is to support safe care and build public trust by building NHS England's cyber resilience and enabling the wider health system to be cyber resilient, supporting Transformation Directorate's purpose of delivering the best care and outcomes for the NHS.
The GRC team, within the CISO Function, plays a critical role by establishing strong governance frameworks, maintaining clear and usable security policies and standards, delivering robust cyber risk management, and providing assurance through compliance, audit, and control effectiveness activities. The team ensures decision makers have clear, evidence based views of security posture and maturity.
As a Cyber Security Analyst in our Security GRC team, you'll play a key role in protecting what matters most, enabling the organisation to operate securely, confidently, and compliantly in an increasingly complex threat landscape.
We are looking for talented security professionals to shape security outcomes, influence decision making, and work at the intersection of technology, risk, and business strategy. You won't just be writing policies, you'll be helping people understand risk, make better decisions, and embed security into everyday ways of working. The role ensures that security controls, policies, and processes align with regulatory requirements, recognised standards, and organisational risk appetite, enabling informed decision making and continuous improvement of the security posture.
Main duties of the job
You will:
- Work with and support Cyber Security Leads to deliver against the requirements of the NHSE Security Model and Cyber Operations Business Plan, thereby helping to reduce overall security risk to the organisation.
- Engage diverse stakeholders on GRC activities to drive security improvements, acting as a point of contact, ensuring communications are actioned in a timely manner to ensure risks and issues are prioritised and managed accordingly.
- Support the development and management of key security metrics, dashboards and reporting to enable informed, evidenced based decision making.
- Provide support to key system and service development teams to ensure a secure by design and continual assurance approach is maintained.
- Support the creation, development and review cycles of data security related technical and non-technical policies, standards, and implementation guides for systems, solutions and services.
- Supporting cyber security governance and assurance activities, producing meeting papers, tracking actions and decisions, and ensuring effective follow up and reporting to senior stakeholders.
- Undertake research and make use of available information from multiple data streams to support, advise and inform decision making on data security best practice.
- Support the organisation with the provision of security advice and guidance to relevant teams within NHS England assuring cyber resilience.
About us
Our staff bring expertise across clinical, operational, commissioning, technology, data science, cyber security, software engineering, education, and commercial specialisms -- enabling us to design and deliver high-quality NHS services.
We lead the NHS in England by:
- Enabling local systems and providers to improve the health of their people and patients and reduce health inequalities
- Making the NHS a great place to work, where people can develop and make a difference
- Working collaboratively to ensure our healthcare workforce has the right knowledge, skills, values and behaviours to deliver accessible, compassionate care
- Optimising the use of digital technology, research, and innovation
- Delivering value for money
Earlier this year, the Government announced that NHS England will gradually merge with the Department of Health and Social Care, to create a smaller, more strategic centre that reduces duplication and waste.
If successful at interview, we will initiate an Inter Authority Transfer (IAT) via the Electronic Staff Record (ESR). This retrieves key data from your current or previous NHS employer to support onboarding, including competency status, Continuous Service Dates (CSD), and annual leave entitlement. You may opt out at any stage of the process.
Colleagues with a contractual office base are expected to spend, on average, at least 40% of their time working in-person.
Staff recruited from outside the NHS will usually be appointed at the bottom of the pay band.
Job description
Job responsibilities
Please see the attached Job Description and Person Specification for more information about the role and responsibilities.
Please ensure your supporting statement includes demonstratable evidence and specific examples on how you meet the criteria for each of the key skills specified. This will be used in both the shortlisting and interview processes
Important: Please be aware there are residency requirements you need to meet:
All NHS England Cyber Security personnel must hold Security Clearance level as a minimum. To meet National Security Vetting requirements, SC clearances require 5 years continuous UK residency. In certain cases, this can be reduced to three years continuous UK residency, with additional overseas checks for the previous two years. Candidates who were posted abroad for service with HM Government, Armed Forces or within a UK government role - will still be considered.Please make sure you meet these requirements before applying for this role. You dont need to have SC already, however, failure to achieve the requirements for SC after offer will result in the job offer being withdrawn. For further advice please check https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels/national-security-vetting-clearance-levels#security-check-sc
Please be aware that should you be successful in this position, you will be hired to the job title of Security Advisor (Corporate) and this job title is advertised to attract the right skills needed for the role.
The post of Security Advisor (Corporate) has been awarded a Recruitment and Retention Premia (RRP) in response to current labour market conditions. In recognition of this, the role attracts an additional monthly RRP payment equal to 20% per annum.Please be aware that RRP is non-contractual and subject to review
Applicants from within the NHS will be offered on a secondment basis only, agreement should be obtained from their employer prior to submitting the application.
Please note that the reason for the fixed term of this contract iscovering maternity leave.
You can find further details about the role,including key responsibilities and accountabilities, alongside theorganisational structureand person specificationin the attached Job Descriptionand other supporting documents.
Secondments
Applicants from within the NHS willbe offered on a secondment basis only, agreementshouldbeobtainedfromtheiremployerpriortosubmittingtheapplication.
Job description
Job responsibilities
Please see the attached Job Description and Person Specification for more information about the role and responsibilities.
Please ensure your supporting statement includes demonstratable evidence and specific examples on how you meet the criteria for each of the key skills specified. This will be used in both the shortlisting and interview processes
Important: Please be aware there are residency requirements you need to meet:
All NHS England Cyber Security personnel must hold Security Clearance level as a minimum. To meet National Security Vetting requirements, SC clearances require 5 years continuous UK residency. In certain cases, this can be reduced to three years continuous UK residency, with additional overseas checks for the previous two years. Candidates who were posted abroad for service with HM Government, Armed Forces or within a UK government role - will still be considered.Please make sure you meet these requirements before applying for this role. You dont need to have SC already, however, failure to achieve the requirements for SC after offer will result in the job offer being withdrawn. For further advice please check https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels/national-security-vetting-clearance-levels#security-check-sc
Please be aware that should you be successful in this position, you will be hired to the job title of Security Advisor (Corporate) and this job title is advertised to attract the right skills needed for the role.
The post of Security Advisor (Corporate) has been awarded a Recruitment and Retention Premia (RRP) in response to current labour market conditions. In recognition of this, the role attracts an additional monthly RRP payment equal to 20% per annum.Please be aware that RRP is non-contractual and subject to review
Applicants from within the NHS will be offered on a secondment basis only, agreement should be obtained from their employer prior to submitting the application.
Please note that the reason for the fixed term of this contract iscovering maternity leave.
You can find further details about the role,including key responsibilities and accountabilities, alongside theorganisational structureand person specificationin the attached Job Descriptionand other supporting documents.
Secondments
Applicants from within the NHS willbe offered on a secondment basis only, agreementshouldbeobtainedfromtheiremployerpriortosubmittingtheapplication.
Person Specification
Knowledge
Essential
- Demonstrable knowledge of the processes, tools and techniques of information security management, ability to deploy and monitor information security systems, as well as detect, resolve and prevent violations of IT security, to protect organisational data.
- Proven knowledge of tools, techniques, approaches and processes of cybersecurity risk management; ability to ensure organisational network operation and minimise negative effect by cybersecurity risks.
Desirable
- Proven knowledge and practical application of resilience methodologies within information and cyber security domains.
- Introductory knowledge of and ability to protect an organisation's data to ensure privacy during the process of storage and communication.
Skills and Experience
Essential
- Demonstrable knowledge of IT security policies, standards, and procedures; ability to utilise a variety of administrative skill sets and technical knowledge to ensure security compliance.
Desirable
- Basic knowledge of and the ability to protect information and information systems while ensuring their confidentiality, integrity and availability.
Qualifications
Essential
- Post graduate level degree or equivalent level of experience.
- Evidence of continuous professional development.
Person Specification
Knowledge
Essential
- Demonstrable knowledge of the processes, tools and techniques of information security management, ability to deploy and monitor information security systems, as well as detect, resolve and prevent violations of IT security, to protect organisational data.
- Proven knowledge of tools, techniques, approaches and processes of cybersecurity risk management; ability to ensure organisational network operation and minimise negative effect by cybersecurity risks.
Desirable
- Proven knowledge and practical application of resilience methodologies within information and cyber security domains.
- Introductory knowledge of and ability to protect an organisation's data to ensure privacy during the process of storage and communication.
Skills and Experience
Essential
- Demonstrable knowledge of IT security policies, standards, and procedures; ability to utilise a variety of administrative skill sets and technical knowledge to ensure security compliance.
Desirable
- Basic knowledge of and the ability to protect information and information systems while ensuring their confidentiality, integrity and availability.
Qualifications
Essential
- Post graduate level degree or equivalent level of experience.
- Evidence of continuous professional development.
Disclosure and Barring Service Check
This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.
