Cyber Security Lead at Infected Blood Compensation Authority in Glasgow, Newcastle-upon-Tyne

Job summary

The Infected Blood Compensation Authority (IBCA) is a new arm’s-length body set up, at unprecedented pace, to administer compensation to people whose lives have been impacted by the infected blood scandal.

IBCA will ensure payment is made in recognition of the wrongs experienced by those who have been infected by HIV, Hepatitis B or C, as well as those who love and care for them. They have been frustrated and distressed by the delays in achieving proper recognition, and we must help put this right.

We are committed to putting the infected and affected blood community at the centre of every decision we make and every step we take to build our organisation to deliver compensation payments.

IBCA employees will be public servants. If successful in this role you will be appointed directly into IBCA, on IBCA terms and conditions as a public servant.

Successful applicants will join the Civil Service Pension Scheme.

Please note that the mission of IBCA means that it is likely to be fully operational for a period of approximately up to 5 years, after which IBCA will become a smaller residual service. When IBCA’s work begins to wind down, IBCA employees will receive support and practical guidance to find a new role, whether in the Civil Service, another Arm's Length Body (ALB), or an external employer.

Job description

As the Cyber Security Lead at IBCA, you will play a vital role in upholding our commitment to the infected, affected, and deceased blood community. We are an organisation built on the principles of integrity, compassion, and transparency, and your work is the foundation that keeps our services secure and reliable. You are not just protecting a network; you are safeguarding the privacy and trust of individuals who have waited decades for recognition and support.

In this position, you will move beyond traditional oversight to foster a culture of security by design that prioritises the needs of the community. You will collaborate across teams to ensure that our digital systems, ranging from claims processing to support services, are resilient and accessible. By balancing technical excellence with a deep sense of empathy, you will help us deliver a service that is both modern and profoundly human, ensuring that every interaction remains safe, dignified, and stable.

As the Cyber Security Lead, you will be responsible for ensuring the architecture of IBCA’s digital infrastructure is secure and resilient. Your role is to balance technical excellence with a service-first mindset, ensuring our systems remain secure and trusted by the community we serve. You will lead risk management strategies that prioritise data security and maintain institutional trust.

Your expertise will guide the selection of security tooling and the implementation of secure engineering principles, ensuring that "security by design" is embedded within every technical design. You will oversee compliance with relevant standards and frameworks while directing overall cyber management and incident readiness.

Beyond the technical, you will lead stakeholder management, translating complex risks into clear, concise guidance for leadership. The ideal candidate will have strong knowledge and experience in the security domains of Security Operations, Security Architecture, and Governance, Risk, and Compliance.

Responsibilities

• Technical Design & Secure Engineering: Act as the primary security design authority for the compensation services architecture. Collaborate with Solution Architects and Developers to implement Secure by Design principles at the code and infrastructure level, ensuring robust identity management (e.g., MFA, RBAC), data encryption at rest and in transit, and secure API integrations across the digital service;
• Security Automation and Tooling: Lead the integration of security into the Software Development Lifecycle (SDLC) by implementing and overseeing DevSecOps practices. This includes managing automated security testing tools—such as Static and Dynamic Application Security Testing (SAST/DAST) and Software Composition Analysis (SCA)—to identify and remediate code vulnerabilities and insecure dependencies in real-time;
• Compliance and Regulatory Oversight: Ensure that all security practices, policies, and systems are fully compliant with relevant regulations, including the Data Protection Act, GDPR, and UK government security standards such as CAF and Secure by Design;
• Cybersecurity Management: Oversee the security of the IT systems and infrastructure used to manage compensation claims, ensuring the implementation of best practices in cybersecurity. Work with IT teams to safeguard against data breaches, hacking attempts, and insider threats;
• Incident Response: In the event of a security breach or data incident, lead the response efforts, including investigating the breach, implementing remedial actions, and liaising with the Information Commissioner’s Office (ICO) and other regulatory bodies.

Person specification

Essential Criteria

• Solid understanding of secure development frameworks (such as the OWASP Top 10 or SANS Top 25) and the ability to apply them within a cloud-native environment. You should have experience reviewing system architectures and code to ensure the implementation of technical controls like Zero Trust principles, robust API security, and secure identity/access management (IAM).
• Practical experience in implementing and managing automated security tools within a CI/CD pipeline. This includes the ability to interpret and act upon results from SAST/DAST (Static/Dynamic Analysis) tools, container scanning, and infrastructure-as-code (IaC) security assessments to ensure vulnerabilities are caught and remediated before they reach production.
• Proven experience of conducting security assurance activities, including providing security assurance for suppliers, ensuring compliance with relevant security regulations and standards and implementing comprehensive security policies and procedures to align with UK government standards and best practice.
• Ability to support the development and delivery of security awareness training programs and experience of promoting a security first culture in the workplace.
• Proven ability and experience of building and managing effective stakeholder relationships to shape the outcomes of a project, considering different individual needs, views, and ideas.
• Influential, and able to communicate in a straightforward, honest, and engaging manner, choosing appropriate styles and tools to maximise and check understanding and impact.
• Demonstrated experience in managing security projects within a sensitive data environment, ideally within a public sector or government agency.
• Ability to identify, assess, and manage security and compliance risks. Knowledge of audit processes, security certifications, and risk management strategies.
• Familiarity with cybersecurity confidentiality, integrity and availability principles, fundamentals of cyber security knowledge, and protection of IT systems used for sensitive data storage and processing.
• Ability to respond quickly to challenges and security incidents, providing practical solutions and guidance to teams and senior management.

Desirable

• Security Certifications: CompTIA Security+, CC – Certified in Cybersecurity, or other relevant security certifications would be advantageous.
• Incident Response Experience: Experience managing or responding to data breaches or cyber incidents, with a focus on minimizing impact and ensuring regulatory compliance.

Additional information:

A minimum 60% of your working time should be spent at your principal workplace. Although requirements to attend other locations for official business will also count towards this level of attendance.

Behaviours

We'll assess you against these behaviours during the selection process:

• Changing and Improving
• Working Together
• Delivering at Pace

Technical skills

We'll assess you against these technical skills during the selection process:

• Threat intelligence and threat assessment
• Protective Security
• Secure operations management

Benefits

Alongside your salary of £60,708, Infected Blood Compensation Authority contributes

£17,587 towards you being a member of the Civil Service Defined Benefit Pension scheme.

Find out what benefits a Civil Service Pension provides (opens in a new window).

• Premium allowance paid monthly after probation
• Learning and development tailored to your role
• An environment with flexible working options
• A culture encouraging inclusion and diversity
• A Civil Service Pension which provides an attractive pension, benefits for dependants and employer contributions of 28.97%
• 32.5 days of paid annual leave plus 8 bank holidays
• Family friendly policies to support you and your everyday responsibilities
• Enhanced maternity and paternity leave, up to 12 months shared parental leave

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window) , and will assess your Behaviours, Experience and Technical skills.

Application information

As part of your application, you will be asked to complete an anonymised CV, which should include your career history, skills, experience and qualifications.

You will also be asked to complete a Personal Statement, of no more than 500 words, that demonstrates how you meet the Essential Skills for the role.

Your CV and Statement of Suitability will be assessed against the essential criteria listed in the 'Person Specification' section of the job advert.

Should you be successful at sift, you will be invited to attend an interview where you will be assessed on Behaviours and Technical Skills.

• Expected timeline (subject to change)
• Expected sift date – W/C 26/10/2026
• Expected interview date/s – W/C 02/11/2026

Interview location - Your interview will be conducted by video.

Reasonable Adjustments

If a person with disabilities is put at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.

If you need a change to be made so that you can make your application, you should:

Contact Government Recruitment Service via IBCA.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs.

Complete the ‘Assistance required’ section in the ‘Additional requirements’ page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.

For further information on National Security Vetting please visit the Demystifying Vetting website.

Sponsorship

IBCA recruitment policy limits Skilled Worker visa sponsorship solely to roles designated as business-critical (internal role not prioritised as hard to fill). Because this position does not fall into that category, we will not be offering sponsorship. Therefore, to be considered for this role, you must be able to demonstrate your right to work in the UK without requiring employer sponsorship.

Further Information

This role is full time only. Applicants who wish to work an alternative pattern are welcome to apply however your preferred working pattern may not be available and you should