Cyber Security Advisor

Position Title

Cyber Security Advisor

NHS England's Chief Information Security Office (CISO) Function's purpose is to enable safe care and build public trust by strengthening the cyber resilience of the NHS. The CISO supports the Technology Digital and Data Directorate's purpose of delivering the best care and outcomes for patients, and enables faster, safer digital transformation of the NHS.

18 June 2026

• Work within a small team dedicated to the assurance of the NHS England supply chain (Third Party Risk Management) and product assurance. You may also be required to support related priority work areas including insider risk and assurance of NHS England security controls / systems.
• Engage diverse stakeholders across NHS England on continual security assurance activities to drive timely security improvements and resilience.
• Support the development and management of key security assurance metrics to enable evidence‑based decision making.
• Support assurance activities in line with applicable frameworks and legislation such as NCSC CAF, NIS Regulations, Gov Assure, HMG Secure by Design, NIST Special Publication 800‑53, ISO 27001/2 and the Data Security and Protection Toolkit.
• Collate, analyse and summarise intelligence on security maturity indicators, audit actions and assurance reporting.
• Undertake line management responsibilities as required.

• Proven knowledge of and the ability to utilise tools and techniques for assessing the effectiveness of information security measures, identifying potential risk exposures, and protecting the availability, confidentiality and audit trails of information from destruction or manipulation.
• Proven knowledge of IT security policies, standards, and procedures; ability to utilise a variety of administrative skill sets and technical knowledge to ensure cyber security compliance.
• Demonstrable knowledge of the processes, tools and techniques of information security management, ability to deploy and monitor information security systems, as well as detect, resolve and prevent violations of IT security, to protect organisational data.

• Demonstrable knowledge of technologies and technology‑based solutions dealing with information security issues; ability to apply these in protecting information security across the organisation.
• Basic knowledge of and the ability to protect information and information systems while ensuring their confidentiality, integrity and availability.

• Post‑graduate level degree in Cyber Security or a relevant subject, or equivalent level of experience.

• Relevant cyber security qualification from a recognised professional body (e.g., CISM, CRISC, CISA, CISSP, SSCP).