Security Assurance Support Coordinator

Security Assurance Support Coordinator

Security As A Service (SyaaS)

Role purpose

The Mid-Level Delivery Team Security Lead (DTSL) will work within the Security as a Service function, supporting a range of programmes, projects and delivery teams as priorities require. The role is responsible for coordinating and delivering defined security-assurance work packages across products, platforms, applications and services, dependencies and supporting platforms. The post holder will help teams apply MOD Secure by Design throughout the capability lifecycle and maintain an evidence-based, proportionate and continually managed security posture.
The post holder will operate with a level of autonomy, taking ownership of assigned activities and artefacts while working under the direction of a Senior DTSL or designated security lead. They may move between projects or portfolios in response to delivery priorities and will engage directly with product owners, application and engineering teams, architects, platform teams and governance stakeholders, identify issues and dependencies, maintain accurate records, and escalate material risks, policy interpretations and acceptance decisions through the appropriate authority.

Key responsibilities

Act as the day-to-day security assurance point of contact for an allocated portfolio with Senior DTSL or designated security-lead oversight.
Support delivery teams to interpret and apply MOD Secure by Design requirements, embedding proportionate security activities into application discovery, design, development, integration, testing, release and in-service change.
Register and maintain digital capabilities in the relevant MOD cyber-risk and assurance tooling, ensuring records, ownership, status and supporting evidence remain current.
Plan and coordinate assurance activity, including defining the assurance approach, selecting an appropriate risk assessment method, identifying applicable control frameworks and agreeing proportionate evidence requirements.
Produce, review and maintain security assurance artefacts, including Governance and Assurance Packs, security risk assessments and treatment plans, threat assessments, vulnerability-management plans, business continuity and disaster-recovery evidence, risk registers, executive summaries and Data Protection Impact Assessment inputs where required.
Coordinate Secure by Design maturity and in-service assurance activity, including evidence mapping, gap analysis, action tracking and preparation for governance or assurance reviews.
Facilitate periodic cyber-risk reviews with delivery teams, normally at least quarterly and following material application, architectural or service change, ensuring risks, actions, dependencies and decisions are recorded and progressed.
Support capability registration and assurance progression, including preparation of evidence needed to unblock CAAT or equivalent assurance milestones.
Monitor delivery against agreed assurance plans, provide concise status reporting, identify blockers and trends, and escalate significant residual risk or overdue actions to the Senior DTSL, designated security lead and accountable stakeholders.
Maintain auditable assurance records in approved repositories, applying appropriate handling, access and classification requirements, including separation of OFFICIAL and SECRET material where applicable.
Build effective working relationships across product, software engineering, architecture, testing, service management, data protection, platform and governance communities, helping stakeholders understand and discharge their security responsibilities.
Contribute to continuous improvement of assurance templates, guidance, ways of working and knowledge-transfer material, and provide proportionate coaching to less-experienced colleagues.

Accountability and decision boundaries

The role may recommend assurance approaches, draft risk and control positions, coordinate evidence and challenge delivery teams within assigned work. Formal risk ownership, risk acceptance, policy exemption, accreditation or authority-to-operate decisions remain with the designated accountable authorities. Novel, high-impact, cross-project, cross-programme or materially disputed matters must be escalated to the Senior DTSL or designated security lead.

Essential experience and capabilities

Practical experience in cyber security, information assurance, technology risk or security governance, with evidence of independently delivering defined assurance…