Key Responsibilities
Security Assurance Regime
Develop, implement, and maintain the security assurance regime for the service — defining the framework, processes, activities, and evidence requirements that demonstrate ongoing security compliance.
Establish and own the security assurance schedule — ensuring assurance activities are planned, executed, evidenced, and reported on a recurring basis.
Define and maintain the security assurance evidence framework — specifying what evidence is required, how it is collected, where it is stored, and how it is presented to accreditation authorities and client security teams.
Accreditation Support & Maintenance
Act as the Contractor's primary point of contact for all security accreditation matters — engaging with the client's Security Accreditation Authority, Information Asset Owners, and Senior Information Risk Owners (SIROs).
Support the accreditation lifecycle.
Maintain a register of all accreditation conditions, caveats, and risk acceptances — tracking compliance and closure.
Security Policy & Procedure Development
Develop, maintain, and enforce security policies and procedures that ensure the Contractor's compliance.
Conduct regular policy reviews to ensure currency with evolving client requirements, regulatory changes, and threat landscape developments.
Manage policy exceptions and deviations through a formal process — ensuring exceptions are risk-assessed, time-bound, approved, and tracked.
Security Risk Governance
Establish and maintain the security risk governance framework for the service — defining how security risks are identified, assessed, recorded, escalated, treated, and reported.
Own and maintain the security risk register.
Chair or participate in security risk governance forums — presenting risk posture, emerging threats, and treatment progress to senior leadership and client stakeholders.
Compliance Management & Audit Support
Ensure the Contractor's ongoing compliance with all applicable security policies, standards, regulations, and contractual obligations.
Develop and maintain a compliance monitoring framework — defining what is monitored, how compliance is measured, and how non-compliance is addressed.
Conduct or commission regular compliance assessments.
Manage non-compliance findings through a formal remediation process — ensuring findings are risk-assessed, prioritised, assigned, tracked, and closed.
Support internal and external security audits by providing evidence, documentation, and subject matter expertise.
Defence Security Posture Management.
Maintain oversight of the overall defence security posture across the service — providing senior leadership and client stakeholders with a clear, evidence-based view of security health.
Identify and escalate security posture degradation — ensuring corrective action is taken before risks materialise.
Ensure the security posture is maintained during periods of change
Personnel Security
Ensure all personnel (employees, contractors, sub-contractors) working on the service meet the required security clearance levels and vetting requirements.
Maintain oversight of personnel security compliance.
Physical & Environmental Security.
Ensure physical security controls for the service are appropriate to the classification and sensitivity of the environments supported.
Maintain oversight of physical security compliance.
Security Incident & Breach Management.
Ensure security incident and breach management processes are defined, documented, tested, and aligned to client and regulatory requirements.
Provide senior security oversight of security incidents
Ensure security incident trends are analysed and feed into risk governance, assurance activities, and process improvement.
At DXC Technology, we believe strong connections and community are key to our success. Our work model prioritizes in-person collaboration while offering flexibility to support wellbeing, productivity, individual work styles, and life circumstances. We’re committed to fostering an inclusive environment where everyone can thrive.
Recruitment fraud is a scheme in which fictitious job opportunities are offered to job seekers typically through online services, such as false websites, or through unsolicited emails claiming to be from the company. These emails may request recipients to provide personal information or to make payments as part of their illegitimate recruiting process. DXC does not make offers of employment via social media networks and DXC never asks for any money or payments from applicants at any point in the recruitment process, nor ask a job seeker to purchase IT or other equipment on our behalf. More information on employment scams is available here.
