Information Assurance and Data Protection Lead

The Ministry of Defence (MOD) is delivering an ambitious Defence Reform agenda to meet a new era of global threat, implementing the Strategic Defence Review through a clearer, simpler, and more joined-up operating model. It will strengthen accountability, streamline processes, reduce duplication, and improve decision making, all underpinned by a One Defence culture. MOD under Reform is organised into four Areas: the Department of State (DOS), which sets strategic direction and enterprise coherence; the Military Strategic Headquarters (MSHQ), which drives military strategy, readiness and operational effect; the National Armaments Director Group (NADG), which oversees capability, equipment and industrial partnerships; and the Defence Nuclear Enterprise (DNE), responsible for the UK’s strategic nuclear capability. Together, these ensure Defence can deter, fight and win, deliver value for money, and enable its people to perform at their best.

At the heart of this is the Department of State (DOS) Area led by the Permanent Secretary, that sets strategic direction for Defence, drives prioritisation and productivity, and provides enterprise level governance through the DoS Management Board (DOS MB). There are several Director-Generals who sit within the DoS; Finance, People, Policy and Transformation, Chief Scientific Adviser and Defence Safety Advisor also aligned to DOS.

This role sits within the Directorate for Business Operations in the Ministry of Defence (MOD) Department of State (DoS), as part of the Director General Finance team, which is responsible for the Security, Safety, Business Resilience, Technology and Accommodation of MOD Main Building as MOD’s strategic headquarters.

DoS is recruiting an SEO Information Assurance/Data Protection (IA/DP) Lead, based in MOD Main Building.

This role will support the Grade 7 Assistant Head to develop and implement IA and DP strategies for DoS and work with DG areas to promote the protection of information and develop a positive Data Protection culture. The IA/DP Lead will ensure policy & legislative requirements are met; an understanding of legislative requirements (DPA18) is therefore essential.

This position is advertised at 37 hours per week. The successful candidate is required to carry out all their duties from a UK location and cannot do so from an overseas location at any time.

You will line manage a team of 2 HEOs (Information Assurance Risk Advisor and Data Protection Advisor), reporting to the Grade 7 KIM and DP Assistant Head.

You will promote IA and DP compliance across DoS, monitoring activities to ensure legislative and statutory obligations are adhered to.

You will advise the Local Data Protection Advisors (LDPAs) to ensure the processing of personal data is compliant, including overseeing the production of DPIAs and supporting commercial colleagues with third party assurance. You will provide advice and guidance on the creation of Data Sharing Agreements and MOUs where personal data is shared outside of commercial arrangements. The IA/DP Lead will support the PDPA in providing regular progress reports to senior management.

As the DP Lead the post holder will assist with personal data incident investigations, working with security colleagues.

The IA/DP Lead will implement the DoS Information Directive, as well as support the development of DoS KIM policies. The post holder will develop DoS policies relating to IA, Information Risk Management and Data Protection.

You will develop an Information Asset Register to capture and manage DoS critical information assets. You will also develop an effective Information Risk Management framework is embedded across DoS, including an Information Risk Register, to drive coherent risk management practices.

Where business needs allow, some roles may be suitable for a combination of office and home-based working. This is a non-contractual arrangement where all office-based employees will be expected to spend a minimum of 60% of their working time in office, subject to capacity and any required workplace adjustments. Requirements to attend other locations for official business, or work in another MOD office, will also count towards this level of attendance. Applicants can request further information regarding how this may work in their team from the Vacancy Holder (see advert for contact details). Defence Business Services cannot respond to any questions about working arrangements.

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

Candidates will be required to provide CV details to include job history; qualification details and previous skills and experience.

At sift, you will be assessed against your CV and the following:

Behaviour

• Leadership

Technical Skills

• IA01 – Managing Information Assets – Practitioner
• IA03 Effective Information Sharing Practices - Practitioner
• IR01 Identifying and Managing Information Risk: Data Protection – Practitioner

If a large number of applications are received, the sift will be conducted only on the basis of CV, personal statement and desirable skills.

At interview, you will be assessed against the following:

Behaviours

• Leadership
• Communicating and Influencing
• Changing and Improving

Technical Skills

• IA01 – Managing Information Assets – Practitioner
• IA03 Effective Information Sharing Practices - Practitioner
• IR01 Identifying and Managing Information Risk: Data Protection – Practitioner

During the application stages, please refer to the Technical Skills Framework: GKIM Skills Framework.

Sift W/C 30th November and interview W/C 7th December.

Further information:

The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

As a result of the changes to the UK immigration rules which came into effect on 1 January 2021, the Ministry of Defence will only offer sponsorship for a skilled worker visa under the points-based system, where a role has been deemed to be business critical. This role does not meet that category, and we will not sponsor a visa. It is therefore NOT open to applications from those who will require sponsorship under the points-based system.

Should you apply for this role and be found to require sponsorship, your application will be rejected and any provisional offer of employment withdrawn.

The Ministry of Defence requires all candidates who are successful at interview to declare any outside interests. These declarations will be discussed with successful candidates following the interview process and before a formal offer of employment is made, as some outside interests may not be compatible with MOD civilian roles. This will not, in the majority of cases, prevent employment in MOD, but it is a measure that must be taken to ensure that appropriate mitigations can be put in place to manage any potential, perceived or actual conflicts of interest from the first day of employment.

The Ministry of Defence adopts a zero-tolerance approach to unacceptable behaviours, which includes bullying, harassment, sexual harassment, discrimination, and victimisation. You will not be eligible and will not be considered for this post if you have been dismissed from a role for such unacceptable behaviours within the last five years. This will also apply if you resign or otherwise leave a role but, because of an adverse decision, would have been dismissed for gross misconduct had you continued in that employment. Pre-employment checks will be carried out.

Feedback will only be provided if you attend an interview or assessment.