Cyber Security Risk Analyst at Government Legal Department in Bristol, Croydon, Leeds, London, Manchester

Job summary

From healthcare to artificial intelligence, energy to national security, we provide legal advice to government departments on nation-changing subjects.

At Government Legal Department we have a vital, single-minded purpose: to help the Government govern well within the rule of law. This is complemented by our exciting vision to be an outstanding legal organisation, committed to the highest standards of service and professionalism and a brilliant place to work where we can all thrive and fulfil our potential.

Our work touches almost every aspect of public life. We are the largest provider of legal services across government, working on high profile matters.

Our respected professionals are involved in everything from regulation and litigation to advice on drafting legislation. They provide expertise to the full range of government departments. We are at the heart of delivering the government’s priorities and our success depends on our people.

GLD is a non-ministerial government department headed by the Treasury Solicitor, our Permanent Secretary, and employs nearly 4000 people, including nearly 3000 legal professionals. We have offices nationwide, in Bristol, Leeds, inner and outer London and Manchester. Our lawyers can also be located within other departments and overseas.

GLD also depends on a range of cross-functional professionals to provide our corporate services. There are nearly 1000 colleagues playing an essential part in helping GLD to achieve its purpose and truly deliver much more than law.

This is an exciting time to join GLD, with cutting edge legal work on global issues and a transformation agenda which is ensuring the Department exemplifies the Modern Civil Service .

To find out more about what we do you can view our introductory film . On our website you can hear from team members, find out how to apply and learn about the benefits of working for GLD. You can also read more about the future vision for GLD in our GLD Strategy 2024 – 2027 .

Job description

​ The Digital, Data and Cyber Division is transforming the way GLD works through modern and secure digital services. ​

We are building an ever expanding and modern digital workplace that empowers our people, strengthens collaboration and enables the organisation to operate efficiently, securely and sustainably. ​

Through agile delivery and user-centred approaches, we design and deliver products and services in partnership with the people who use them, ensuring solutions meet real needs and deliver lasting value.

As part of the wider Government Digital and Data profession , we play a key role in transforming how government operates, enabling better outcomes for colleagues, stakeholders and the public we serve.

The Role

Join GLD at an exciting stage in the evolution of its Cyber Security capability. At the heart of our day-to-day Cyber operations, you’ll turn complex risks into clear, practical decisions—helping new services, applications, suppliers and technology changes move forward securely and with confidence.

You’ll collaborate with technical teams, service owners, suppliers and governance leaders to uncover cyber risks, shape practical solutions and ensure confident, well-evidenced decisions.

This is an ideal opportunity for someone organised, curious and pragmatic—an engaging communicator who can make cyber security clear and relevant to both technical and non-technical audiences.

Key Responsibilities

• Drive day-to-day cyber security operations, coordinating requests, tracking risks, progressing vulnerabilities and building robust evidence.
• Shape secure technology change through the Change Advisory Board, challenging risk, testing and rollback plans to support confident decisions.
• Deliver proportionate Security Risk Assessments for new applications, services, suppliers, contracts and significant technology changes.
• Strengthen supply-chain assurance by assessing how third parties access, process, host and connect to GLD data and systems.
• Review cloud, SaaS, Microsoft 365, Azure, on-premises and hybrid environments to improve access, configuration, monitoring and resilience.
• Advance GLD’s security maturity through penetration testing, vulnerability remediation, ISO 27001, Cyber Essentials Plus and audit activity.
• Turn complex cyber requirements into clear, practical actions by collaborating with service owners, Commercial, Information Governance, suppliers and technical teams.

Person specification

Behaviours

Below are details of the Success Profiles that make up this role. Demonstrating all the behaviours listed below is essential at either application or interview. You can read more about Success Profiles and how they are used as an assessment method before completing your application .

We'll assess you against these behaviours during the selection process:

• Communicating and influencing
• Making effective decisions

Key Skills and Experience

Essential – must be demonstrated at application and interview

• Experience in cyber security, cyber risk, security assurance or compliance, with strong knowledge of identifying, assessing, managing and communicating cyber security risks within a complex digital environment.
• Experience of conducting or contributing to security risk assessments, reviewing technical, security and supplier information, identifying vulnerabilities and control gaps, and making clear, proportionate recommendations.
• Good understanding of third-party and supply-chain security risks and cyber resilience, including business continuity and disaster recovery.
• Good understanding of security controls across cloud, SaaS and hybrid environments, including identity and access management technologies such as Microsoft 365, Active Directory, Microsoft Entra ID, multi-factor authentication and privileged access management.
• Experience of working collaboratively with technical specialists, service owners, suppliers and other stakeholders, providing effective challenge and supporting informed, risk-based decisions.
• Understanding of security assurance frameworks, vulnerability management and audit activity, and how these contribute to improving organisational cyber security.

Desirable – must be demonstrated at application and interview

• Knowledge of ITIL change and configuration management, including the security considerations associated with technology change.
• Familiarity with SIEM and vulnerability management tools.
• Understanding of penetration testing principles, including how findings are assessed, prioritised and remediated.
• Knowledge of security standards and assurance schemes such as ISO 27001 and Cyber Essentials Plus.

Desirable criteria will be used when there is a need to distinguish between candidates who are closely tied or the same after the initial consideration of essential criteria, at sift and interview.

Qualifications

Desirable

• Cloud Security certification Risk Management certification
• Cyber Vulnerability Management Certificate

Desirable criteria will be used when there is a need to distinguish between candidates who are closely tied or the same after the initial consideration of essential criteria, at sift and interview.

Technical Professional Skills

Essential – must be demonstrated at application and interview

This is a hybrid role, meaning the role sits across two roles in the in the Government Cyber Profession . The primary role is the Lead cyber security governance and risk manager. The secondary role is the Lead cyber security audit and assurance manager role. We will be assessing your experience and technical professional skills against the skills listed below:

Lead cyber security governance and risk manager skills

• Information risk assessment and risk management
• Applied security capability
• Protective security
• Threat understanding

Cyber security audit and assurance manager skills

• Compliance monitoring and controls testing
• Legal and regulatory environment and compliance
• Secure supply chain management

Security Clearance Level

All GLD employees must successfully obtain Baseline Personnel Security Standard (BPSS) clearance before starting employment.

This role requires Security Check (SC) clearance. You may start employment once BPSS clearance has been completed and while your SC clearance application is being processed; however, obtaining and maintaining SC clearance is a condition of employment. If you are unable to obtain or maintain SC clearance, you may not be able to remain in the role you have been appointed to and this may lead to the termination of your contract or offer of employment.

Current SC clearance requirements typically include a 5-year verifiable UK residency history , with no more than 6 months spent outside the UK in the preceding 12 months . You will be asked to confirm whether you believe you meet these requirements as part of your application. This information will not be used as part of the assessment process.

As security vetting requirements are determined by the relevant vetting authority and may change over time, applicants are encouraged to review the latest UK Security Vetting guidance before applying via United Kingdom Security Vetting: Applicant Guidance .

Sponsorship and Visa Information

Visa sponsorship will not be given to candidates except where they are existing civil servants employed by GLD, who meet the HO/UKVI requirements for sponsorship. If you are an existing civil servant employed by GLD who requires sponsorship, you should confirm your eligibility for sponsorship for this role prior to application. Individuals should seek Home Office guidance on how new positions with the organisation impact on changes to sponsorship eligibility.

Candidates with Limited Leave to Remain can apply but must have at least 12 months remaining on an existing visa which allows them to work for GLD when employment commences. Candidates must ensure that their current visa dates cover the entire period of employment or that they are eligible for non-sponsored immigration routes, to allow their employment with GLD to continue for the duration of this role.

The expectation is that applicants have an existing visa, which at the point they start work with GLD has at least 12 months remaining on it. The share code you provide for your pre-employment checks must be linked to the visa that allows you to work for a minimum of 12 months in the role for which you have applied. This does not include having any outstanding visa applications in process during the recruitment process.

It is your responsibility to ensure that you have the right to work in the UK and hold an appropriate visa or are on an alternative route that covers the entire period of your employment. Please note, GLD will not be able to provide sponsorship for this role when your current visa arrangements expire and you will not be able to continue in your employment with GLD via sponsorship. Please allow three months for the onboarding process from the point of offer.

Candidates with Indefinite Leave to Remain can apply.

Behaviours

We'll assess you against these behaviours during the selection process:

• Communicating and Influencing
• Making Effective Decisions

Technical skills

We'll assess you against these technical skills during the selection process:

• Technical professional skills

Benefits

Alongside your salary of £43,500, Government Legal Department contributes

£12,601 towards you being a member of the Civil Service Defined Benefit Pension scheme.

Find out what benefits a Civil Service Pension provides (opens in a new window).

• Learning and development tailored to your role
• An environment with flexible working options
• A culture encouraging inclusion and diversity
• A Civil Service pension with an employer contribution of 28.97%

Benefits of working for the Civil Service

Whatever your role, we take