Cyber Security Assurance Assurance Specialist (DSPT / CAF) - Home-Based

ISR Recruitment

1d•Remote

About The Position

Our consultancy client is partnered with a major UK Government Agency and are seeking an experienced DSPT & Cyber Assessment Framework (CAF) Assurance Specialist to provide specialist assurance across a significant data security and cyber resilience programme. The organisation is currently undertaking a programme focused on compliance with the Data Security and Protection Toolkit (DSPT) and the NCSC Cyber Assessment Framework (CAF). The programme is developing proposals, controls and actions to address identified gaps. The requirement now is for an experienced assurance professional who can independently assess whether those proposals and actions are appropriate, effective and delivering the intended improvement in organisational maturity; providing an evidence-based view of the current state, assess the effectiveness of remediation activity, identify remaining gaps and help ensure that improvement plans translate into sustainable security and data protection outcomes. You'll be a credible assurance professional comfortable with reviewing evidence, challenging proposed solutions and determining whether controls are actually operating effectively; equally comfortable discussing cyber risk with technical specialists and presenting clear, concise assurance findings to senior programme and organisational stakeholders.

Requirements

Significant professional experience in cyber security, information assurance, security governance, risk or compliance, with demonstrable experience assessing organisational maturity against security or data protection frameworks.
Practical experience working with the Data Security and Protection Toolkit (DSPT) and working with the NCSC Cyber Assessment Framework (CAF).
Experience undertaking assurance, audit, assessment or independent review activity within NHS, healthcare, Government or another highly regulated environment, reviewing evidence and determining whether controls and remediation activity are genuinely effective.
Strong understanding of cyber security governance, risk management and control frameworks.
Ability to translate framework requirements into practical assurance questions, evidence requirements and measurable outcomes, with strong analytical skills and the ability to identify gaps, risks, weaknesses and dependencies.
Excellent stakeholder management skills, including the confidence to challenge senior stakeholders constructively, producing clear assurance reports, recommendations, action plans and executive-level briefings.

Nice To Haves

Experience working within the NHS, DHSC, UK Government or Government Arm's Length Bodies.
Previous experience acting as an independent DSPT assessor or assurance provider.
Experience with CAF-aligned DSPT assessments.
Knowledge of NHS information governance and data protection requirements.
Experience with ISO 27001, NIST, Cyber Essentials / Cyber Essentials Plus or similar security frameworks.
Experience with risk and control frameworks, audit methodologies or maturity models.
Experience supporting cyber transformation, remediation or organisational improvement programmes.

Responsibilities

Provide independent assurance across DSPT and CAF-related activities, proposals and remediation plans.
Assess the organisation's current maturity against relevant DSPT and CAF requirements.
Review existing assessments, evidence, controls, improvement plans and supporting documentation.
Evaluate whether proposed actions are appropriately designed to address identified risks and gaps.
Assess whether completed actions and controls are operating effectively and producing the intended outcomes.
Identify weaknesses, residual risks, dependencies and areas requiring further remediation.
Provide clear, evidence-based assurance findings and recommendations to senior stakeholders.
Challenge assumptions and proposed approaches where evidence does not demonstrate sufficient assurance.
Support the development and maintenance of maturity assessments, assurance plans, action plans and evidence repositories.
Map findings and recommendations against relevant DSPT and CAF outcomes, principles and indicators of good practice.
Work closely with Cyber Security, Information Governance, Data Protection, Risk, Compliance and Programme teams.
Support the establishment of appropriate measures and evidence to demonstrate sustainable improvement.
Contribute to governance forums, assurance reviews and senior-level reporting.
Help ensure that improvements are embedded into business-as-usual processes rather than treated solely as point-in-time compliance activity.