Lead Security Risk Assurance Manager

About this role

Details

This post currently attracts an additional Recruitment & Retention Allowance of

£7,000 per annum. This is reviewed on an annual basis.

A Civil Service Pension with an employer contribution of 28.97%

GBP

Job grade

Business area

DWP - Finance - Security & Data Protection - Enterprise Security & Risk Management

Type of role

Governance

Risk Management

Security

Working pattern

Flexible working, Full-time, Job share, Part-time

Number of jobs available

4

Contents

• Location
• About the job
• Benefits
• Things you need to know
• Apply and further information

Please note that for candidates requesting to work in Blackpool, this role will initially be based at Peel Park, Brunel Way, Blackpool and then at Fylde View in Blackpool town centre by the end of April 2027.

Please note that for candidates requesting to work in Newcastle, this role will initially be based at Benton Park View, and then at 1 Pilgrim Place in Newcastle city centre by the end of 2027.

Please note that for candidates requesting to work in Sheffield, this role will initially be based at either Hartshead Square or Kings Court. Colleagues in Hartshead Square will move to 1 West Bar, Sheffield city centre by summer 2027 and colleagues based in Kings Court will move to the same new location by autumn 2027.

About the job

Job summary

Each year DWP is responsible for delivering approximately £280 billion in benefits and pensions, with over eight hundred physical locations and around 1000 commercial suppliers. DWP holds substantial personal data and manages several critical digital systems and key elements of the Government’s critical national infrastructure.

Enterprise Security & Risk Management (ESRM) supports the secure delivery of DWP business, empowering the Department to operate within its security risk appetite, prioritise security improvement activities and maximise return on security investment.

As a senior leadership position in ESRM a Lead Security Risk Assurance Manager holds responsibility for producing high‑quality enterprise‑level security risk assessments or security risk assurance reports that can inform decision-making at the highest levels including Director General Finance, the Executive Team, and Departmental Audit & Risk Assurance Committee (DARAC).

This includes the identification and monitoring of enterprise-level security risks, contextualising principal security threats to identify strategic risks to DWP and help inform departmental security policy. Alternatively, a Lead Security Risk Assurance Manager will, ensure delivery of security assurance activities, undertake and oversee multiple activities to gather evidence on the security posture of DWP assets and services for example: interviews, sampling, design review, IT health checks and controls testing. ESRM analyse findings from these activities to provide confidence that DWP is sufficiently secure or identify areas for improvement.

A Lead Security Risk Assurance Manager is vital in understanding the big picture, synthesising information, and articulating how security risks could impact the department’s ability to operate, deliver services, maintain resilience, and protect staff, data, and assets.

The position requires an individual who can understand complex and interconnected risks across a large organisation, influence senior stakeholders, challenge assumptions, and provide clear, evidence-based advice on whether controls are effective, thus, enabling informed business decisions. Working across multiple functions and disciplines, the successful candidate will help DWP deliver its objectives securely, resiliently and effectively.

ESRM provide confidence through evidence, placing a strong focus on continuous improvement, looking wider and deeper than just compliance. We highlight good practice and provide a professional, impartial view of the potential improvements to the department’s security position.

Job description

Lead an area of Enterprise Security Risk or Security Assurance

• Develop, maintain and lead the production of timely Enterprise Security Risk or Assurance Products for senior leaders
• Oversee multi‑layered risk and assurance analysis covering threat scenarios, impacts, effectiveness of controls, and residual risk.

Deliver Complex Security Risk Analysis

• Identify interdependencies and cumulative impacts across systems, services and business areas, translating localised risks into an enterprise-wide understanding of potential consequences
• Break down large, ambiguous or abstract security problems into structured analytical components
• Gather, evaluate and synthesise information from diverse sources, including digital risk data, system-level risk assessments, threat intelligence, estate vulnerabilities, resilience data and people safety insights
• Apply structured analytical methods to generate robust findings, uncertainty judgements, and evidence‑based conclusions.

Influence Decision Makers

• Understand complex and interconnected risks, provide balanced and pragmatic advice that supports senior leaders in making informed decisions, recognising both risk exposure and business objectives
• Produce clear, actionable insights to inform Director General level decision‑making, risk appetite setting, and departmental prioritisation
• Articulate business impacts: how risks could affect operations, resilience, service delivery, customer experience, staff safety or data protection
• Support senior leaders (for example DWP's Finance Director General (DG) as risk owner) by outlining options, consequences and recommended mitigations.

Stakeholder Leadership and Engagement

• Build credibility with senior leaders, influencing across organisational boundaries and constructively challenging assumptions where required
• Build strong relationships with senior stakeholders across Digital, Estates, People Safety, Risk & Resilience, Commercial and wider security teams
• Coordinate and convene stakeholders to gather evidence, test assumptions and validate analysis.

Team Leadership and Delivery Management

• Lead, mentor and quality‑assure the work of a small team of colleagues
• Task and oversee scenario‑level analysis (for example physical estate failure scenarios, cyber resilience scenarios)
• Shape team capability, drive continuous improvement and support professionalisation of ESRM’s analytical approach.

Strategic and Tactical Risk Support

• Enable the business to achieve its objectives securely by identifying practical options, mitigations and routes to delivery within agreed risk appetite.
• Lead thematic/strategic risk assessments for priority business areas (for example arm’s length bodies)
• Deliver tactical assessments when the business requests security input on emerging issues (for example reviewing new operating models, or outreach activities)
• Provide options and recommendations while enabling the business to understand and own its risk decisions.

Given the geographic spread of our team, DWP customers, cross-government stakeholders and industry suppliers, you'll need to be willing to travel to other**DWP****locations,****with****periodic****overnight****stays****required.

Person specification

We would love to hear from you if you can demonstrate your skills and experience across all the following essential criteria:

Experience providing risk assessment or assurance or decision support within large,**complex environments involving multiple stakeholders, competing priorities and distributed accountabilities, alongside a strong understanding of security or risk principles.

Transferable experience (such as threat analysis, operational risk, resilience, or intelligence) is equally valuable.

About security roles for ex-police

Security management, operations and consultancy roles. Years of operational policing — command, incident response, public order — translate directly into corporate security, and employers in this sector actively rate police experience.