Senior cyber security manager

Band 8b · Cyber security manager · 606 job evaluation points

A senior cyber security manager leads cyber security across several teams, manages assurance against sector standards, and runs the organisation's security improvement programme.

Responsibilities

Lead cyber security teams across operations, engineering, and assurance.
Run the organisation's cyber security improvement programme and manage its budget.
Manage assurance against sector cyber security standards and ISO/IEC 27001 controls, and prepare evidence for audits.
Lead the response to major cyber incidents, and plan and test recovery with business continuity and clinical leads.
Assess the security of suppliers and shared services, and agree security requirements in contracts.
Advise programme boards on the security risks of new clinical and digital services.

Skills

Skill	Expected level	What this level means
Cyber security governanceUK GDaD PCF	Practitioner (3)	Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level. You can: Examples of leadership using this skill: develop an effective cyber and information security governance framework that is integrated with overall organisational governance prioritise issues affecting the organisation’s ability to meet security policies and follow standards lead a continuous review process to ensure governance meets changing regulations, legislation and best practices mitigate risks caused by unavoidable exceptions to the governance framework escalating risks to the highest level in the organisation when governance issues do not have defined owners persuading others to use their financial resources for changes needed to comply with the framework helping stakeholders be aware of the risks that are caused when an exception is agreed
Cyber risk managementUK GDaD PCF	Practitioner (3)	Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level. You can: Examples of leadership using this skill: maintain a clear understanding of the cyber and information security risks across the whole organisation develop and implement risk assessment processes oversee the assessment of the organisation's partners and supply chain for potential threats or vulnerabilities building a culture where teams have awareness of, and take responsibility for, risks and mitigating them advising programme owners and people running IT services about risks in a way that enables them to act on that advice communicating with senior leaders in a way that enables them to make decisions about accepting or mitigating risk
Cyber incident managementUK GDaD PCF	Practitioner (3)	Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level. You can: Examples of leadership using this skill: implement cyber incident management processes that reflect the level of risk accepted by the organisation ensure the organisation is prepared for and can effectively respond to incidents determine the impact of critical incidents on the organisation’s technology lead the response to critical incidents that affect the whole organisation helping the incident management team build relationships with senior leaders leading simulation exercises with the board so they understand their role in incident response processes and the implications of potential incidents assessing what to communicate to the board, ministers or the whole organisation, and when to do it
Changing security cultureUK GDaD PCF	Practitioner (3)	Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level. You can: Examples of leadership using this skill: put in place continuous cyber and information security awareness and education programs, for example, training for specific groups use a range of methods to assess whether people’s security behaviour is improving compare the maturity of security awareness and culture in your organisation against others across government to determine effective improvements incentivising the right behaviours across the whole organisation so that everyone knows how they contribute to security persuading senior leadership to represent a campaign personally communicating insights from previous incidents to ensure they are learned from
Strategic cyber security planningUK GDaD PCF	Working (2)	Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level. You can: Examples of leadership using this skill: determine the right balance between the organisation's cyber and information security capabilities, acceptable level of risk and speed of technology progress decide areas that need security investment create a security roadmap that enables the organisation to achieve its objectives explaining the mutual benefits of the security strategy to a range of stakeholders and teams to bring them onboard advising other leaders on how to integrate security requirements in their strategies ensuring security is part of all the organisation's initiatives, despite competing priorities gaining support for investment in security from other leaders
Information governance and data protectionThis reference	Practitioner (3)	You can: lead data protection impact assessments and information sharing agreements advise teams on lawful basis, consent, confidentiality, and retention investigate incidents and recommend improvements
Organisational risk managementThis reference	Practitioner (3)	You can: run the risk process for a directorate or programme assess risks against the risk appetite and escalate them report on risks to committees
Understanding health and care servicesThis reference	Practitioner (3)	You can: analyse how a service fits into care pathways across organisations work with clinicians, care staff, and patients to shape digital services explain the effect of digital decisions on care, safety, and staff workload
People managementThis reference	Practitioner (3)	You can: line manage a team, setting objectives and running appraisals support wellbeing and manage attendance, performance, and conduct plan the team's development and succession
Budget managementThis reference	Working (2)	You can: track spending against a small budget and raise variances authorise spending within your limit

Typical qualifications and experience

Extensive experience of leading cyber security teams in a complex organisation.
A recognised professional security certification, or equivalent experience.

Band 8b outline

Knowledge: Expert knowledge across several disciplines or a large service.
Autonomy: Shapes policy and strategy for a large area.
Scope: Several services or teams, or a principal-level discipline.
Leadership: Manages managers, or is the principal authority in a discipline.
Accountability: Several services, their staff, and their budgets.

Job evaluation (illustrative)

Factor	Level	Level summary	Points
Communication and relationship skills	5	Gives highly complex or contentious information needing developed persuasion and negotiation, presents to large groups, or communicates where there are significant barriers to acceptance.	45
Knowledge, training, and experience	7	Highly developed specialist knowledge across the range of the specialism (master's level or equivalent).	196
Analytical and judgemental skills	5	Judgements on highly complex facts or situations needing analysis, interpretation, and comparison of options.	60
Planning and organisational skills	5	Forms long-term strategic plans, with uncertainty and effects across the organisation.	60
Physical skills	2	Skills gained through practice, such as standard keyboard use or driving.	15
Responsibility for patient and client care	1	Helps patients, clients, or relatives during incidental contact.	4
Responsibility for policy and service development	4	Implements policy and develops policy or services for a service or several areas.	32
Responsibility for financial and physical resources	4	Holds or sets the budget for a department or service, or buys or maintains its assets.	32
Responsibility for people	4	Line manages a function or department, designs training programmes as a main duty, or delivers a full range of HR services.	32
Responsibility for information resources	5	Designs and develops major information systems, or runs information systems for several services as the main duty.	34
Responsibility for research and development	2	Regularly does research, development, trials, or equipment and system testing as part of the job.	12
Freedom to act	5	Works within general policies, and in most cases decides how to interpret them.	45
Physical effort	1	Sitting, standing, and walking, with little physical effort.	3
Mental effort	4	Frequent prolonged concentration, or occasional intense concentration.	18
Emotional effort	2	Occasional exposure, or frequent indirect exposure, to distressing circumstances.	11
Working conditions	2	Occasional unpleasant conditions, frequent travel or outdoor work, or near-continuous screen use on most days.	7
Total (Band 8b: 585 to 629)			606

Mental and emotional effort reflect leading the response to major cyber incidents, which can last days or weeks and threaten patient care.