Senior Cyber Safety Oversight Specialist

Salary and Contract

Salary: Up to £69,524 dependent upon experience

Contract Type: 12 Month Fixed Term Contract

Security Level: SC

Visa Restrictions: This position does not offer visa sponsorship

We are the UK's aviation and aerospace regulator and recognised as a world leader in its field. Our activities are diverse, enabling the aviation industry to meet the highest safety standards, and we pride ourselves on our ability to adapt to the constantly evolving aviation environment.

• To contribute to delivering an oversight framework that satisfies the CAA’s regulatory responsibilities in respect of the Network and Information Security (NIS) Regulations, cyber requirements in various safety regulations (including 965/2012, 1321/2014, 2017/373, 139/2014), and future cyber regulations that the CAA may be tasked with overseeing (e.g. UK ISMS, CSRB).
• To provide subject matter expertise regarding cyber safety in aviation.
• To support the aviation industry by developing and supporting standards, guidance, acceptable means of compliance, and future cyber regulation – doing so in line with the Regulators’ Code and our obligations under the Legislative and Regulatory Reform Act 2006.
• To enable the wider CAA to manage the safety and security consequences of a Cyber event.
• Work with Oversight Lead on strategy for oversight, providing quality assurance of audits/oversight activities, generate management information, report on oversight activities, and report on levels of compliance within industry.
• Manage how aviation organisations are meeting cyber safety requirements in regulations that apply to them. Integrate with Performance Based Regulation/Oversight where it makes sense to do so.
• Day to day line management of team of Cyber Safety Oversight Specialists, working with Oversight Lead to ensure effective resource allocation to support the delivery of the CAA’s cyber objectives and implementation of regulatory requirements.
• Devise oversight mechanisms to enable oversight of regulated entities. Monitor the success of those mechanisms and update them when necessary.
• Define which regulated entities will be subjected to oversight taking into account threats, the complexity and exposure to risk of the entity, its attack surface, and the impact of the entity being compromised. Define how much oversight is required for each entity.
• Oversee accredited third parties. Define the standards we require those third parties to meet. Ensure they meet them and hold them to account when they don’t.
• Maintain up-to-date knowledge of cyber security vulnerabilities, trends, threats and new technologies.
• Be the cyber safety subject matter expert for your team of Oversight Specialists, for industry, and for other parts of the CAA.
• Report on industry’s compliance with the cyber safety regulations that apply to them.
• Stay up to date with the latest regulatory changes. Determine what oversight needs to be done for those regulations. Implement that oversight.
• Develop and deliver cyber training and guidance for the Oversight team, for other parts of the CAA, and for industry.
• Ensure all cyber oversight activity complies with the requirements laid out in the Regulators’ Code. Ensure we meet the requirements placed upon the Authority in all relevant aviation legislation.
• Guide and work closely with accredited third parties in line with the CAA’s Cyber Oversight model.
• Review of relevant cyber information, mitigation plans, and perform ongoing oversight to determine compliance by regulated entities.
• Develop and deliver aviation cyber training and guidance as necessary.
• Review aviation cyber safety risk through threat and vulnerability assessments, effectively communicating this to both industry and relevant CAA capability areas to inform safety and security decision making.
• High levels of stakeholder liaison both within and outside the CAA, incorporating other regulatory bodies and industry groups.

To be considered for the role you must have:

• A degree in a relevant technical subject (e.g. computer science, cyber security, or an aviation related subject); a qualification deemed to be equivalent to a degree and relevant to the role; or…