Information Technology Security Specialist

Hybrid working (1-3 days a week in London)

You’ll report to the senior leader responsible for security governance and risk. You’ll help plan, coordinate, track and report on the organisation’s information security activity. As a specialist, you’ll advise on how security systems, policies and procedures are designed and applied, working alongside IT teams and business units so that company data stays protected from security threats.

• Help keep the security strategy aligned with wider business goals
• Work with IT and the business so security principles and policies are built into projects, culture and day-to-day behaviour
• Support the handling of security risk assessments and audits
• Help mature and run robust security governance processes
• Monitor and manage security risk, encourage good practice, and report to ensure risk stays at an acceptable level
• Support security compliance obligations and the assurance that controls perform as intended
• Act as the go-to point of security expertise across the organisation

• Help develop, align and roll out the security strategy
• Draft, review and maintain security policies
• Support an ongoing security awareness programme, and deliver training where needed
• Make sure policies, procedures and standards are accessible and understood by employees, contractors and suppliers
• Attend relevant governance forums so risk is managed transparently and effectively
• Pull together audit findings and drive remediation through to closure
• Build management dashboards that show the organisation’s security risk position
• Act as the business’s subject matter specialist on security
• Foster a culture where information and systems are actively protected

• Help maintain the security risk register, ensuring risks are actively managed or any exceptions are approved and recorded
• Run security risk assessments and workshops
• Keep risk governance and control frameworks current, and escape issues appropriately
• Review, challenge and track the delivery and effectiveness of controls and mitigation plans arising from assessments
• Make sure any vulnerability that could expose information or systems gets proper management attention
• Log and monitor security incidents, checking that mitigations are proportionate and exposure is kept low
• Support incident response as needed
• Drive continuous improvement in security services

• Monitor relevant laws, regulations, standards and frameworks that affect information security
• Assess how well key controls perform and comply, including access management, identity and authentication, system and network protection, configuration management, vulnerability management and incident response
• Own and maintain a year-long, rolling compliance calendar

• Demonstrable background in security governance, risk and compliance
• Strong cyber risk knowledge, with experience across several frameworks and standards