Consultant in Privacy and Information Security

Project overview

Background:

DSS provides 'Executive Recruitment' as a service to the government community. The service is delivered by the Executive Recruitment Section (TREK), and ministries can order assistance and advice in connection with the recruitment of top executives in the ministry (Permanent Secretary, Director-General, and Head of Communications) and the top leader of an underlying business. The service typically includes active market search for potential candidates and is independent of geography and field. The service largely resembles services provided by private consulting firms in executive search.

TREK shall procure a 'database for storage, systematization, and use of relevant information about potential candidates for top leadership positions in the state'. TREK is itself responsible for assessments related to purpose, legal basis for processing, storage, etc. In this work, they receive assistance from the department's privacy advisor. In the database procurement, TREK initially wants the database to be a web-based cloud solution. This is based on thorough market research conducted by TREK, which shows that all the most relevant suppliers only deliver web-based cloud solutions.

In the work with the procurement documentation for the procurement, TREK receives assistance from DSS's Procurement Section (ANS). ANS assists with commercial procurement support, including the choice of procurement procedure, preparation of, among other things, qualification requirements and award criteria, structuring and defining what is actually to be purchased, and publication of the competition.

Assignment:

DSS needs one consultant with information security expertise to assist in the procurement. The team will then consist of the consultant, subject matter experts from TREK, a commercial procurement advisor from ANS, and a privacy advisor.

DSS's ISMS is based on ISO 27001. The consultant shall assist with all necessary information security assessments related to the procurement of the database for TREK, based on this framework and DSS's own routines. The consultant is responsible for producing all necessary documentation.

The consultant shall be the contact person with the client, be responsible for the delivery, and quality assurance of the delivery.

Scope and Tasks

Part 1

DSS must assess the choice of delivery model and document the assessments. Although the Digitalization Circular mandates consideration of cloud services, a cloud solution will not automatically be correct or legal for every processing activity. The choice must be based on documented legal assessments, risk, privacy, and information security. DSS needs assistance with these assessments, as well as preparing a short decision memo related to the procurement of a web-based cloud service. This may involve assessments related to several regulations, including privacy regulations and the Security Act.

Part 2

Conduct risk assessments that address both information security and personal data security according to GDPR. The result of the risk assessment will, if necessary, be documented as mandatory requirements ('skal-krav') and desirable requirements ('bør-krav') in the requirements specification published with the procurement.

Quality assure/draft mandatory requirements ('skal-krav') and desirable requirements ('bør-krav') that must be included in the requirements specification.

Assist in evaluating the proposals regarding information security when they have been received and provide short written assessments of the relevant proposals.

The consultant must have close dialogue with the procurement advisor and subject matter experts in DSS throughout the process for progress, dialogue, and production of all necessary documents.

Part 3

Quality assure the risk assessments after the supplier has been selected and more information is available about the type of solution being delivered.

Identify and document routines for the use of the database before DSS puts it into use.

Competence and Experience:

Qualities:

• Consultant with a minimum of 8 years of experience or more in the tasks specified.
• Minimum formal competence at Master's degree level or equivalent in the field. Long and documented experience can compensate for the requirement for formal competence.
• Solid competence in information security in the public sector.
• Good competence and experience related to information security and recognized standards in the field, including the ISO 2700x series.
• Good experience in conducting risk assessments.
• Knowledge of DFØ's Marketplace for Cloud Services, including Requirements for Information Security in Cloud Agreements – reference architecture.
• Good competence and understanding of privacy regulations, including experience in identifying issues and conducting DPIAs.
• Good ability to communicate clearly and effectively with both technical and administrative environments, including being able to present the case to DSS's controlling and governing functions such as the Data Protection Officer and CISO.
• Good ability to work independently, but also in close collaboration in an interdisciplinary environment.

Project details

As soon as possible to 31.01.2027

Scope: 100 hours

Option: The assistance may be extended and the number of hours increased by agreement, in line with the duration of the procurement.

Remote/by agreement

• Start: flexible
• Duration: 1-3 months
• Remote: remote
• Location: Norway, NO
• Languages: Norwegian