Ofsted registered provider

ESFA & DfE approved

0333 772 9534

safeguarding@nationalupskill.co.uk

Book a chat

Cyber Security Technician

Build core operational defence skills: security monitoring, incident response triage, access control and compliance auditing.

Programme overview

Build core operational defence skills: security monitoring, incident response triage, access control and compliance auditing.

How it is delivered

Every apprentice is paired with a dedicated, industry-experienced tutor for 1:1 coaching scheduled around your workplace, with Off-The-Job training built into real projects and Functional Skills support where needed.

What you will learn

Every apprenticeship follows a national occupational standard. These are the knowledge, skills and behaviours the apprentice will build and be assessed on.

The role in one sentence

Provide first line cyber security support

Knowledge (30) What the apprentice will know
  1. K1: Principles of organisational information security governance and the components of an organisation's cyber security technical infrastructure including hardware, operating systems, networks, software and cloud
  2. K2: Cyber security policies and standards based on an Information Security Management System (ISMS)
  3. K3: Types of physical, procedural and technical controls
  4. K4: Awareness of how current legislation relates to or impacts upon the occupation including Data Protection Act, Regulation of Investigatory Powers Act, Human Rights Act, Computer Misuse Act, Freedom of Information Act, Official Secrets Act, Payment Card Industry Data Security Standard (PCI-DSS), Wireless and Telegraphy Act, professional body codes of conduct, ethical use of information assets
  5. K5: Cyber security awareness and components of an effective security culture, different organisational structures and cultures, the importance of maintaining privacy and confidentiality of an organisation's information and the impact of a poor security culture
  6. K6: Principles of cyber security compliance and compliance monitoring techniques
  7. K7: Core terminology of cyber security – confidentiality, integrity, availability (the CIA triad), assurance, authenticity, identification, authentication, authorization, accountability, reliability, non-repudiation, access control
  8. K8: Common security administrative operational tasks e.g. patching, software updates, access control, configuring a range of firewalls, security incident and event management tools (SIEM) and protection tools (Anti-virus, Anti-malware, Anti-spam)
  9. K9: Cryptography, certificates and use of certificate management tools
  10. K10: Processes for detecting, reporting, assessing, responding to, dealing with and learning from information security events
  11. K11: Principles of identity and access management – authentication, authorisation and federation – and the inter-relationship between privacy and access rights and access control, and the types of access control, access control mechanisms and application control
  12. K12: Types of digital information assets used in a controlled environment and the need to maintain an inventory of information assets used in a controlled environment and the need for and practice of secure information asset disposal
  13. K13: Disaster prevention and recovery methods and the need for continuity of service planning and how an organisation might implement basic disaster prevention and recovery practices using conventional and incremental secure backup and recovery techniques and tools both onsite and offsite including geographic considerations
  14. K14: Categories of cyber security vulnerabilities and common vulnerability exposures –software misconfiguration, sensitive data exposure, injection vulnerabilities, using components with known vulnerabilities, insufficient logging and monitoring, broken access control and authentication, security misconfiguration, incorrect cross-site validation
  15. K15: Components of a vulnerability assessment scope and techniques to evaluate the results of a vulnerability assessment and provide recommendations based upon the evidence provided by the vulnerability assessment tools. The impact that vulnerabilities might have on an organisation and common vulnerability assessment tools and their strengths and weaknesses
  16. K16: Threat sources and threat identification and network reconnaissance techniques and the impact that threats might have on an organisation
  17. K17: Types of information security events – brute force attack, malware activity, suspicious user behaviour, suspicious device behaviour, unauthorized system changes
  18. K18: Computer forensic principles – the importance of ensuring that evidence is not contaminated and maintaining the continuity of evidence without compromising it
  19. K19: Standard information security event incident, exception and management reporting requirements and how to document incident and event information as part of a chain or evidence
  20. K20: Common information security policies – acceptable use, incident management, patching, anti-virus, BYOD, access control, social media, password, data handling and data classification, IT asset disposal
  21. K21: Cyber security audit requirements, procedures and plans, need to obtain and document evidence in an appropriate form for an internal or external auditor to review
  22. K22: The significance of customer issues, problems, business value, brand awareness, cultural awareness/ diversity, accessibility, internal/ external audience, level of technical knowledge and profile in a business context
  23. K23: Evolving cyber security issues in the digital world including the application to critical national infrastructure, communications technologies, the need for information assurance and governance, control systems and internet of things (IoT) devices
  24. K24: Different learning techniques and the breadth and sources of knowledge and sources of verified information and data
  25. K25: Importance of maintaining privacy and confidentiality of an organisations information and the impact of a poor security culture
  26. K26: Concepts of service desk delivery and how to respond to requests for assistance received by a service desk and be able to describe different methods of escalation, when to escalate to a higher level where necessary and the need to communicate accurately and appropriately during an escalation
  27. K27: Risk assessment, risk management and business impact analysis principles
  28. K28: How their occupation fits into the wider digital landscape and any current or future regulatory requirements
  29. K29: How to use data ethically and the implications for wider society, with respect to the use of data
  30. K30: Roles within a multidisciplinary team and the interfaces with other areas of an organisation
Skills (22) What the apprentice will be able to do
  1. S1: Follow information security procedures
  2. S2: Maintain information security controls
  3. S3: Develop information security training and awareness resources
  4. S4: Monitor the effectiveness of information security training and awareness
  5. S5: Handle and assess the validity of security requests from a range of internal and external stakeholders
  6. S6: Follow technical procedures to install and maintain technical security controls
  7. S7: Monitor and report information security events
  8. S8: Recognise when and how to escalate information security events in accordance with relevant procedures and standards
  9. S9: Review and modify access rights to digital information systems, services, devices or data
  10. S10: Maintain an inventory of digital information systems, services, devices and data storage
  11. S11: Scopes cyber security vulnerability assessments
  12. S12: Evaluate the results of a cyber security vulnerability assessment
  13. S13: Perform routine threat intelligence gathering tasks through consulting external sources
  14. S14: Undertake digital information risk assessments
  15. S15: Identify and categorise threats, vulnerabilities and risks in preparation for response or escalation
  16. S16: Document cyber security event information whilst preserving evidence
  17. S17: Draft information management reports using standard formats appropriate to the recipients
  18. S18: Review and comment upon cyber security policies, procedures, standards and guidelines
  19. S19: Perform cyber security compliance checks
  20. S20: Translate audit requirements and collate relevant information from log files, incident reports and other data sources
  21. S21: Communication skills to co-operate as part of a multi-functional, multi-disciplinary team using a range of technical and non-technical language to provide an effective interface between internal or external users and suppliers
  22. S22: Keep up-to-date with legislation and industry standards related to the implementation of cyber security in an organisation
Behaviours (7) How the apprentice will work
  1. B1: Manage own time to meet deadlines and manage stakeholder expectations
  2. B2: Work independently and take responsibility for own actions within the occupation
  3. B3: Use own initiative
  4. B4: A structured approach to the prioritisation of tasks
  5. B5: Treat colleagues and external stakeholders fairly and with respect without bias or discrimination
  6. B6: Act in accordance with occupation specific laws, regulations and professional standards and not accept instruction that is incompatible with any of these
  7. B7: Review own development needs in order to keep up to date with evolution in technologies, trends and innovation using a range of sources
Duties (18) The tasks of the job, and the KSBs each one uses
  1. Duty 1: Apply procedures and controls to maintain security and control of an organisation. Uses K1, K2, K3, K4, K7, K29, S1, S2, S21, S22, B2, B4
  2. Duty 2: Contribute to the production and development of security culture across an organisation including assisting with the promotion of cyber security awareness programmes, monitoring the effectiveness of cyber security awareness programmes, promoting an effective cyber security culture Uses K4, K5, K6, K7, K25, K29, K30, S3, S4, S21, S22, B5, B6
  3. Duty 3: Process cyber security helpdesk requests ensuring confidentiality, integrity and availability of digital information, meeting relevant legal and regulatory requirements for example access control requests. Uses K4, K7, K8, K22, K26, S1, S5, S21, S22, B1, B2, B3, B4, B5, B6
  4. Duty 4: Conduct the installation and maintenance of technical security controls in accordance with relevant procedures and standards. Uses K1, K3, K8, K9, S1, S2, S6, S21, S22, B1, B2, B4
  5. Duty 5: Monitor, identify, report and escalate information security incidents and events in accordance with relevant procedures and standards. Uses K1, K2, K7, K10, K17, K19, S1, S7, S8, S21, S22, B1, B2, B3, B4, B5, B6
  6. Duty 6: Administer cryptographic and certificate management activities in accordance with relevant procedures and standards. Uses K3, K9, S1, S2, S6, B1, B2, B4
  7. Duty 7: Conduct regular review of access rights to digital information assets in accordance with relevant procedures and standards. Uses K1, K2, K3, K11, K12, S1, S2, S9, B1, B2, B4
  8. Duty 8: Maintain an asset register of controlled environments in accordance with relevant policies, procedures and standards. Uses K1, K2, K3, K12, S1, S10, B1, B2, B4
  9. Duty 9: Assist with backup and recovery processes in accordance with relevant policies, procedures and standards. Uses K1, K2, K3, K13, K15, S1, S6, B1, B2, B4
  10. Duty 10: Contribute to documenting the scope and evaluating the results of vulnerability assessments in accordance with management requirements. Uses K1, K2, K14, K15, K16, K17, K18, S1, S11, S12, B1, B2, B4, B5, B6
  11. Duty 11: Contribute to risk assessments and escalate where appropriate in accordance with relevant procedures and standards. Uses K1, K2, K4, K19, K20, K27, S1, S14, S15, S21, S22, B1, B2, B4, B5
  12. Duty 12: Contribute to routine threat intelligence gathering tasks. Uses K1, K2, K4, K16, S1, S13, B1, B2, B4, B5
  13. Duty 13: Document incident and event information and incident, exception and management reports in accordance with relevant policies, procedures and standards. Uses K1, K2, K10, K17, K18, K19, K20, K21, S7, S8, S16, S17, S19, B1, B2, B4
  14. Duty 14: Contribute towards the production and review of cyber security policies, procedures, standards and guidelines drawing on their experience of applying policies for example – acceptable use, incident management, patching, anti-virus, bring your own device (BYOD), access control, social media, password, data handling and data classification, information technology asset disposal Uses K1, K2, K4, K7, K20, K23, S18, S21, S22, B1, B2, B4, B5, B6
  15. Duty 15: Monitor cyber security compliance and provide relevant data to auditors if required by the auditor. Uses K1, K2, K4, K6, K21, K24, K25, S19, S20, B1, B4, B5, B6
  16. Duty 16: Collaborate with people both internally and externally to support secure and uninterrupted business operations of an organisation. Uses K1, K2, K4, K23, K25, K26, K28, K30, S1, S2, S4, S21, B1, B3, B4, B5, B6
  17. Duty 17: Practice continuous self-learning to keep up to date with industry trends and developments to enhance relevant skills and take responsibility for own professional development. Uses K4, K23, K24, K27, S22, B2, B3, B4, B7
  18. Duty 18: Monitor and detect potential security threats and escalate in accordance with relevant procedures and standards. Uses K1, K16, K19, K26, S8, S13, S15, S22, B1, B2, B4

Source: Skills England, Cyber security technician (ST0865 v1.1). Contains public sector information licensed under the Open Government Licence v3.0.
Read the end-point assessment plan (PDF)

In their words

What our apprentices say.

Read our reviews on Trustpilot