Ofsted registered provider

ESFA & DfE approved

0333 772 9534

safeguarding@nationalupskill.co.uk

Book a chat

Cyber Security Technologist

Advanced threat intelligence, security architecture, vulnerability management and cyber risk governance for modern technical teams.

Programme overview

Advanced threat intelligence, security architecture, vulnerability management and cyber risk governance for modern technical teams.

How it is delivered

Every apprentice is paired with a dedicated, industry-experienced tutor for 1:1 coaching scheduled around your workplace, with Off-The-Job training built into real projects and Functional Skills support where needed.

What you will learn

Every apprenticeship follows a national occupational standard. These are the knowledge, skills and behaviours the apprentice will build and be assessed on.

The role in one sentence

Apply an understanding of cyber security to protect from attacks and unauthorised access.

Knowledge (17) What the apprentice will know
  1. K1: Principles of networks: OSI and TCP/IP models, data, protocols and how they relate to each other; the main routing protocols; the main factors affecting network performance including typical failure modes in protocols and approaches to error control; virtual networking.
  2. K2: the concepts, main functions and features of at least three Operating Systems (OS) and their security functions and associated security features.
  3. K3: Cyber security concepts and why cyber security matters to business and society; Security assurance concepts and how assurance may be achieved in practice including penetration testing and extrinsic assurance methods.
  4. K4: the main types of common attack techniques; also the role of human behaviour, including the significance of the 'insider threat'. Including: how attack techniques combine with motive and opportunity to become a threat. Techniques and strategies to defend against attack techniques and mitigate hazards.
  5. K5: the significance of identified trends in cyber security threats and understand the value and risk of this analysis. How to deal with emerging attack techniques (including 'zero day'), hazards and vulnerabilities relevant to the digital systems and business environment.
  6. K6: lifecycle and service management practices to an established standard to a foundation level for example Information Technology Infrastructure Library (ITIL) foundation level.
  7. K7: cyber incident response processes, incident management processes and evidence collection/preservation requirements to support incident investigation.
  8. K8: Understands the main features, applicability and how to apply the significant law, regulations and standards relevant specifically to cyber security. To include: laws, regulations & standards relating to personal data and privacy (e.g. Data Protection Act 2018 implementing General Data Protection Regulation); use of digital systems (e.g. Computer Misuse Act 1990 ); regulatory standards for cyber security, intelligence collection and law enforcement (e.g. Intelligence Services Act 1994, Regulation of Investigatory Powers Act 2000; standards for good practice in cyber security (e.g. ISO 27001, CyberEssentials, NIST) and any updates or additions.
  9. K9: ethical principles and codes of good practice of at least one significant cyber security professional body and the ethical responsibilities of a cyber security professional.
  10. K10: how to analyse employer or customer requirements to derive security objectives and taking account of the threats and overall context develop a security case which sets out the proposed security measures in the context with reasoned justification.
  11. K11: horizon scanning including use of recognised sources of threat intelligence and vulnerabilities.
  12. K12: common security architectures and methodologies; be aware of reputable security architectures that incorporates hardware and software components, and sources of architecture patterns and guidance. How cyber security technology components are typically deployed in digital systems to provide security functionality including: hardware and software to implement security controls.
  13. K13: the basic terminology and concepts of cryptography; common cryptography techniques in use; the importance of effective key management and the main techniques used; legal, regulatory and export issues specific to the use of cryptography.
  14. K14: risk assessment and audit methodologies and approaches to risk treatment; approaches to identifying the vulnerabilities in organisations and security management systems; the threat intelligence lifecycle; the role of the risk owner in contrast with other stakeholders.
  15. K15: principles of security management systems, including governance, organisational structure, roles, policies, standards, guidelines and how these all work together to deliver the identified security outcomes.
  16. K16: function and features of significant digital system components; typical architectures; common vulnerabilities in digital systems; principles and common practice in digital system security.
  17. K17: programming or scripting languages.
Skills (30) What the apprentice will be able to do
  1. S1: Discover vulnerabilities in a system by using a mix of research and practical exploration.
  2. S2: Analyse and evaluate security threats and hazards to a system or service or processes. Use relevant external source of threat intelligence or advice (e.g. National Cyber Security Centre) Combine different sources to create an enriched view of cyber threats and hazards.
  3. S3: Research and investigate common attack techniques and relate these to normal and observed digital system behaviour and recommend how to defend against them. Interpret and demonstrate use of external source of vulnerabilities (e.g. OWASP, intelligence sharing initiatives, open source).
  4. S4: Undertake security risk assessments for simple systems without direct supervision and propose basic remediation advice in the context of the employer.
  5. S5: Source and analyse security cases and describe what threats, vulnerability or risks are mitigated and identify any residual areas of concern.
  6. S6: Analyse employer or customer requirements to derive security objectives and taking account of the threats and overall context develop a security case which sets out the proposed security measures in the context with reasoned justification.
  7. S7: Identify and follow organisational policies and standards for information and cyber security and operate according to service level agreements or other defined performance targets.
  8. S8: Configure, deploy and use computer, digital network and cyber security technology.
  9. S9: Recommend improvements to the cyber security posture of an employer or customer based on research into future potential cyber threats and considering threat trends.
  10. S10: Design, build, test and troubleshoot a network incorporating more than one subnet with static and dynamic routes, to a given design requirement without supervision. Provide evidence that the system meets the design requirement.
  11. S11: Analyse security requirements given (functional and non-functional security requirements that may be presented in a security case) against other design requirements (e.g. usability, cost, size, weight, power, heat, supportability etc.) for a given system or product. Identify conflicting requirements and propose, with reasoning, resolution through appropriate trade-offs.
  12. S12: Design and build, systems in accordance with a security case within broad but generally well-defined parameters. This should include selection and configuration of typical security hardware and software components. Provide evidence that the system has properly implemented the security controls required by the security case.
  13. S13: Write program code or scripts to meet a given design requirement in accordance with employers' coding standards.
  14. S14: Design systems employing encryption to meet defined security objectives. Develop and implement a plan for managing the associated encryption keys for the given scenario or system.
  15. S15: Use tools, techniques and processes to actively prevent breaches to digital system security.
  16. S16: Conduct cyber-risk assessments against an externally (market) recognised cyber security standard using a recognised risk assessment methodology.
  17. S17: Identify cyber security threats relevant to a defined context.
  18. S18: Develop information security policies or processes to address a set of identified risks, for example from security audit recommendations.
  19. S19: Develop information security policies within a defined scope to take account of legislation and regulation relevant to cyber security.
  20. S20: Take an active part in a security audits against recognised cyber security standards, undertake gap analysis and make recommendations for remediation.
  21. S21: Develop plans for incident response for approval within defined governance arrangements for incident response.
  22. S22: Develop plans for local business continuity for approval within defined governance arrangements for business continuity.
  23. S23: Assess security culture using a recognised approach.
  24. S24: Design and implement a simple ‘security awareness’ campaign to address a specific aspect of a security culture.
  25. S25: Integrate and correlate information from various sources (including log files from different sources, digital system monitoring tools, Secure Information and Event Management (SIEM) tools, access control systems, physical security systems) and compare to known threat and vulnerability data to form a judgement based on evidence with reasoning that the anomaly represents a digital system security breach.
  26. S26: Recognise anomalies in observed digital system data structures (including by inspection of network packet data structures) and digital system behaviours (including by inspection of protocol behaviours) and by inspection of log files and by investigation of alerts raised by automated tools including SIEM tools.
  27. S27: Accurately, objectively and concisely record and report the appropriate cyber security information, including in written reports within a structure or template provided.
  28. S28: Configure digital system monitoring and analysis tools (e.g. SIEM tools), taking account of threat & vulnerability intelligence, indicators of compromise.
  29. S29: Undertake root cause analysis of events and make recommendations to reduce false positives and false negatives.
  30. S30: Manage local response to non-major incidents in accordance with a defined procedure.
Behaviours (10) How the apprentice will work
  1. B1: Logical – Applies logical thinking, for example, uses clear and valid reasoning when making decisions related to undertaking the work instructions.
  2. B2: Analytical – working with data effectively to see patterns, trends and draw meaningful conclusions.
  3. B3: Works independently and takes responsibility. For example works diligently regardless of how much they are being supervised, and stays motivated and committed when facing challenges.
  4. B4: Shows initiative, being resourceful when faced with a problem and taking responsibility for solving problems within their own remit.
  5. B5: Thorough & organised. For example uses their time effectively to complete work to schedule and takes responsibility for managing their own work load and time.
  6. B6: Works effectively with a wide range of people in different roles, internally and externally, with a regard to inclusion & diversity policy.
  7. B7: Communicates effectively in a wide variety of situations for example contributing effectively to meetings and presenting complex information to technical and non-technical audiences.
  8. B8: Maintains a productive, professional and secure working environment.
  9. B9: Creative – taking a variety of perspectives, taking account of unpredictable adversary and threat behaviours and approaches, bring novel and unexpected solutions to address cyber security challenges.
  10. B10: Problem Solving – Identifies issues quickly, solves complex problems and applies appropriate solutions. Dedicated to finding the true root cause of any problem and find solutions that prevent recurrence.
Duties (23) The tasks of the job, and the KSBs each one uses
  1. Duty 1: Identify cyber vulnerabilities in a system to ensure security is maintained. Uses K1, K2, K3, K4, K5, K11, K12, K13, K15, K16, K17, S1, S9, B1, B2, B4, B5, B6, B7, B8, B9
  2. Duty 2: Identify security threats and hazards to a system, service or processes to inform risk assessments and design of security features. Uses K4, K5, K11, S2, S9, S17, B1, B2, B5, B6, B7, B9, B10
  3. Duty 3: Research and investigate attack techniques and recommend ways to defend against them. Uses K2, K4, K5, K13, K15, S3, S9, B1, B2, B3, B4, B5, B6, B7, B8, B9, B10
  4. Duty 4: Support cyber security risk assessments, cyber security audits and cyber security incident management. Uses K4, K5, K7, K8, K9, K14, S4, B1, B2, B3, B5, B6, B7, B8, B10
  5. Duty 5: Develop security designs with design justification to meet the defined cyber security parameters. Uses K3, K4, K8, K10, S5, S6, B1, B2, B9, B10
  6. Duty 6: Configure, deploy and use computer, digital network and cyber security technology. Uses K1, K2, K16, K17, S8, B1, B3, B4, B10
  7. Duty 7: Develop program code or scripts for a computer or other digital technology for example an industrial control system. Uses K1, K16, K17, S13, B1, B2, B3, B5, B8, B10
  8. Duty 8: Write reports, give verbal reports and presentations in the context of the cyber security role. Uses S27, B1, B3, B4, B5, B7, B9
  9. Duty 9: Manage cyber security operations processes in accordance with organisational policies and standards and business requirements. Uses K3, K6, K8, K9, K15, S7, B1, B3, B5, B6, B8
  10. Duty 10: Participate in cyber war gaming and simulations (technical & non-technical).for example to better understand cyber-attack and defence, rehearse responses, test and evaluate cyber security techniques. Uses K1, K2, K4, K9, K15, K16, K17, S1, S2, S4, B1, B2, B3, B4, B5, B6, B7, B8, B9, B10
  11. Duty 11: Keep up to date with industry trends and developments to enhance relevant skills and take responsibility for own professional development. Uses K8, K9, B3
  12. Duty 12: Work from a given design requirement to design, build and test digital networks. Uses K1, K2, K16, K17, S10, B1, B3, B5, B8, B10
  13. Duty 13: Analyse security requirements and develop a security case taking account of all applicable laws and regulations. Uses K3, K8, K10, S5, B1, B2, B3, B5, B8, B9, B10
  14. Duty 14: Implement structured and reasoned security controls in a digital system in accordance with a security case. Uses K12, K13, K15, S11, S12, S14, B1, B2, B3, B4, B5, B6, B7, B8, B9, B10
  15. Duty 15: Conduct cyber security risk assessments. Uses K1, K2, K3, K4, K5, K8, K14, K16, K17, S1, S2, S3, S4, S16, S17, S22, B1, B2, B3, B4, B5, B6, B7, B8, B9, B10
  16. Duty 16: Conduct cyber security audits. Uses K8, K9, K14, S20, B1, B3, B5, B6, B7, B8
  17. Duty 17: Manage local response to non-major cyber security incidents. Uses K6, K7, K8, K9, K15, S21, S30, B1, B2, B3, B4, B5, B6, B7, B8, B10
  18. Duty 18: Monitor technology systems (for example computer networks and computer systems) in real time to detect cyber security incidents, breaches and intrusions. Uses K4, K5, K6, K7, K8, S2, S7, S25, B1, B2, B3, B4, B5, B6, B7, B8
  19. Duty 19: Integrate and correlate information from a variety of sources and form an informed judgement on whether an indicator constitutes a likely security incident, breach or intrusion. Uses K3, K4, K5, S26, S27, S29, B1, B2, B3, B4, B5, B6, B7, B8, B10
  20. Duty 20: Respond to a suspected security incident, breach or intrusion in accordance with organisation procedures any defined service level agreements or performance targets. Uses K6, K7, K9, K15, S7, B1, B5, B6, B7, B8
  21. Duty 21: Develop information security policies to achieve security outcomes within a defined scope. Uses K3, K8, K15, S18, S19, B1, B2, B3, B4, B5, B6, B7, B8, B9, B10
  22. Duty 22: Prevent security breaches using a variety of tools techniques and processes. Uses K1, K2, K3, K4, K5, K8, K9, K15, K16, K17, S1, S2, S3, S15, S28, B1, B2, B3, B4, B5, B6, B7, B8, B9, B10
  23. Duty 23: Design and implement security awareness campaigns. Uses K3, K4, K8, S17, S23, S24, B3, B4, B5, B6, B7, B9

Source: Skills England, Cyber security technologist (2021) (ST1021 v1.1). Contains public sector information licensed under the Open Government Licence v3.0.
Read the end-point assessment plan (PDF)

In their words

What our apprentices say.

Read our reviews on Trustpilot