Security engineer
Security engineers design, build, and run the technical security controls that protect the organisation's systems, data, and users. They work on identity and access, endpoint and network protection, encryption, logging, and cloud security, and help product and infrastructure teams build security in. In health care, they protect clinical systems and patient data while keeping access fast for clinicians at the point of care.
- Family
- Cyber security
- UK GDaD PCF role
- None: this reference defines the role
- ESCO occupations
- ICT security administrator (ISCO-08 2529)
- On GitHub
- Role document · Role data
Levels
| Band | Role level | UK GDaD PCF level | Civil Service grades | Job evaluation points |
|---|---|---|---|---|
| 6 | Security engineer | — | — | 434 |
| 7 | Senior security engineer | — | — | 490 |
| 8a | Lead security engineer | — | — | 560 |
In a digital health care organisation
- Security controls must not get in the way of urgent care, so engineers design strong authentication that still works quickly on shared clinical workstations.
- Medical devices and legacy clinical systems often cannot be patched or run security software, so engineers design network segmentation and compensating controls.
- Ransomware is a major threat to health care, so engineers harden systems, protect backups, and limit how far an attack can spread.
- Clinical systems are often supplied and supported by third parties, so engineers assess supplier security and control their remote access.
- Changes to security controls on clinical systems go through change management and, where needed, clinical safety review.
ESCO occupations and skills
ESCO lists the skills and knowledge that employers usually need (essential) or may need (optional) for each occupation. Use them as a checklist for development conversations.
ICT security administrator
ICT security administrators plan and carry out security measures to protect information and data from unauthorised access, deliberate attack, theft and corruption.
Essential skills and knowledge (25)
Skills and competences
- apply company policies
- attend to ICT systems quality
- ensure proper document management
- identify ICT system weaknesses
- interpret technical texts
- maintain ICT identity management
- maintain database security
- manage ICT data architecture
- manage IT security compliances
- perform ICT troubleshooting
- solve ICT system problems
Knowledge
- ICT network security risks
- Internet of Things
- cyber attack counter-measures
- database development tools
- ethical hacking principles
- internet governance
- mobile device management
- network standards
- operating systems
- organisational resilience
- quality assurance methodologies
- security engineering
- system backup best practice
Other
Optional skills and knowledge (34)
Skills and competences
- address problems critically
- assess ICT knowledge
- build business relationships
- execute ICT audits
- execute software tests
- implement ICT security policies
- implement a firewall
- implement a virtual private network
- implement anti-virus software
- implement cloud security and compliance
- lead disaster recovery exercises
- manage ICT virtualisation environments
- manage cloud data and storage
- manage database
- manage keys for data protection
- perform backups
- protect personal data and privacy
- remove computer virus or malware from a computer
- respond to incidents in cloud
- store digital data and systems
- train employees
- use scripting programming
Knowledge
Contains ESCO v1.2.1 data (https://esco.ec.europa.eu/). © European Union. Reuse authorised under Commission Decision 2011/833/EU.