Her Majesty’s Passport Office
Security Operations Engineer
10 Incomplete applications
9 SME, 1 large
9 Completed applications
8 SME, 1 large
Important dates
- Published
- Wednesday 18 October 2017
- Deadline for asking questions
- Friday 20 October 2017 at 11:59pm GMT
- Closing date for applications
- Wednesday 25 October 2017 at 11:59pm GMT
Overview
- Specialist role
- Cyber security consultant
- Summary of the work
-
• Security Operations lead for Cloud Platform and in-house on Premise hosting
• Lead embedding of security in cloud based, microservices based architecture, automating where possible
• Conducting vulnerability assessments and penetration tests
• Ensure services kept in line with security architecture and standards - Latest start date
- Friday 1 December 2017
- Expected contract length
- Up to two years (24 months)
- Location
- London
- Organisation the work is for
- Her Majesty’s Passport Office
- Maximum day rate
About the work
- Early market engagement
- Who the specialist will work with
- Working with Platform Engineers, and developers, tech architects
- What the specialist will work on
-
• Ensuring that deployed code is secure and assured.
• Ensuring Cloud infrastructure complies with security architecture and policies
• Conducting or ensuring internal security testing for each Agile sprint/release
• Leading/conducting code & configuration security reviews
• Leading/implementing remediation activity
• Vulnerability management
• Liaison with Her Majesty’s Passport Office Information Assurance team to provide the required security assurances for code releases
• Operational security support
• Porting security (protective monitoring) log feeds to the CSOC/SEIM.
• Subject matter expert on DevOps security,
• Provisioning, administering and reviewing Developer user access & privileges
Work setup
- Address where the work will take place
- Petty France, London
- Working arrangements
-
The individual will work full time from the primary office in Petty France, London five days a week. Option to work from home one day a week.
Candidate should be prepared to use their own company laptop which may be needed to undertake some duties.
There may be an occasional need to attend our other office in Central London (Victoria). No travel expenses will be paid for this purpose. Expenses for any exceptional travel authorised outside of Central London will fall under the Standard Government Terms and Conditions for Expenses as covered in the DOS Contract - Security clearance
- DV Clearance is required.
Additional information
- Additional terms and conditions
-
We expect this engagement to be outside IR35, however status is assessed on a case-by-case basis.
Standard Government Terms and Conditions for Expenses as covered in the DOS Contract.
Skills and experience
Buyers will use the essential and nice-to-have skills and experience to help them evaluate suppliers’ technical competence.
- Essential skills and experience
-
- 10+ years hands-on security experience, with a focus on endpoint, network devices, and applications.
- Experience with vulnerability management tools such as Nessus, Qualys, etc.
- Experience with SIEM tools, such as AlienVault, Splunk ES, ELK/Logstash, etc
- Experience with security testing tools such as BurpSuite, ZAP, etc.
- Understanding of secure coding development practice, e.g. OWASP Top Ten, etc.
- Incident Response analysis and investigations.
- Ethical Hacker experience
- Experience and working knowledge of Linux/Unix.
- Nice-to-have skills and experience
-
- Knowledge of networking protocols and technologies, e.g. TCP/IP, Switching & Routing, etc.
- Recognised security qualification (e.g CREST, AWS Security, CCSP etc)
- Programming and scripting skills, Python, JAVA, etc.
- General knowledge around endpoint security, malware analysis, BYOD, etc.
- Have exisiting, valid DV Clearance
How suppliers will be evaluated
- How many specialists to evaluate
- 3
- Cultural fit criteria
-
- Work as a team with our organisation and other suppliers
- Take responsibility for their work
- Be transparent and collaborative when making decisions
- Share knowledge and experience with other team members
- Assessment methods
- Work history
- Evaluation weighting
-
Technical competence
70%Cultural fit
10%Price
20%
Questions asked by suppliers
- 1. Could you please clarify the security clearance requirement for this role as is states DV clearance is required but it is also listed as a nice to have skill.
- Existing DV Clearance has been included as a Nice to have, however Her Majesty’s Passport Office will sponsor and support the security process if the candidate does not have valid DV Clearance.
- 2. Would this role require AWS / Cloud Computing expertise / experience?
- Yes.
- 3. Does the Passport Office have a maximum day rate in mind , or are they open to current commercial rates based on experience?
- The maximum day rate has been left blank intentionally, we will assess the day rate for suppliers using the evaluation weighting we have disclosed on the requirements.
- 4. What is the rate for this role?
- The day rate has been left blank intentionally, we will assess the day rate for suppliers using the evaluation weighting we have disclosed on the requirements
- 5. How many individuals are required?
- One
- 6. Does HMPO have a maximum daily rate for this role?
- The maximum day rate has been left blank intentionally, we will assess the day rate for suppliers using the evaluation weighting we have disclosed on the requirements.
- 7. Will HMPO sponsor DV for those candidates holding SC already?
- Current DV clearance is preferred but Her Majesty's Passport Office will support the process for the successful candidate.
- 8. Would you consider individuals with the ability to apply for DV Clearance?
- Yes.
- 9. Would this position be inside IR35?
- We expect this engagement to be outside IR35, however status is assessed on a case-by-case basis.
- 10. Please indicate your maximum day rate for this role.
- The maximum day rate has been left blank intentionally, we will assess the day rate for suppliers using the evaluation weighting we have disclosed on the requirements.