Chief Information Security Officer

Location: City of Edinburgh

About The Role

The Chief Information Security Officer (CISO) is a senior leader responsible for establishing and maintaining the organisation's vision, strategy, and programs related to information security. The CISO plays a crucial role in safeguarding the organisation's sensitive data, intellectual property, and information systems from potential threats and cyberattacks.

The CISO collaborates with various departments, including IT, legal, business risk, and business units, to ensure the implementation of effective security measures and adherence to industry best practices and regulatory requirements. As CISO, you will be responsible for :

Information Security Strategy

• Develop and communicate a comprehensive information security strategy that aligns with the overall business goals and objectives.
• Ensure adherence to this strategy across the entire technology estate.

Risk Management

• Identify, assess, and prioritise security risks, considering potential impact on the organisation's operations, reputation, and finances.
• Implement security risk mitigation measures and ensure the development of an information security risk-aware organisational culture.

Security Governance

• Work with the Data Protection team to establish and maintain the organisation's information security governance framework and ensure appropriate technical guardrails are in place, including policies, standards, and procedures.
• Ensure compliance with applicable laws, regulations, and industry standards (e.g., GDPR, ISO 27001, NIST Cybersecurity Framework).

Incident Response

• Oversee the development and testing of technology incident response plans.
• Coordinate with relevant stakeholders to promptly respond to and resolve cybersecurity incidents, minimising damage and potential downtime.

IT Continuity

• Ensure DR testing takes place and provide support to the Business Risk division to manage IT continuity risks.
• Represent IT continuity in the Business Risk and DR committee.

Security Architecture

• Collaborate with IT teams to design, implement, and maintain secure IT infrastructure, applications, and networks.
• Working with the IT Architecture team, ensure that security controls are built into technology solutions from the outset.

Vendor and Third-Party Risk Management

• Implement a robust process to assess and monitor the security posture of third-party vendors and service providers with access to the organisation's systems or data.

Security Compliance and Auditing

• Regularly review security measures and support internal audits to assess the effectiveness of security controls. Address any findings and ensure timely remediation.

Security Incident Reporting

• Report to leadership on the organisation's security posture, potential risks, and ongoing security initiatives.
• Communicate effectively to raise awareness and support for information security initiatives.
• Chair and / or act as an active member of Security Governance forums, including the Risk Management Committee.

Industry Knowledge and Innovation

• Stay abreast of the latest cybersecurity threats, trends, and technologies.
• Evaluate and introduce innovative security solutions to enhance the organisation's overall security posture.

Budgeting, Supplier and Cost Control

• Prepare and manage the Information Security department budget, controlling expenses, and optimising spending while maintaining high standards of service delivery.
• Manage department suppliers appropriately ensuring value for money, and the timely delivery of services, aligning to the technology and company procurement and supplier strategy requirements.

Team Leadership

• Lead, mentor, and inspire the Information Security team, ensuring team members have the necessary resources and support to excel in their roles.
• Foster a culture of innovation, accountability and collaboration within the Information Security team and across departments.
• Define ways of working and standards for Information Security in MO technology.
• Work with key partners in the business to define ways of working and build up a consistent approach to Information Security.
• Build new capabilities where there are gaps in the existing organisation.

About You Minimum Criteria

• Proven significant experience in information security, and in a leadership role.
• Strong knowledge of cybersecurity principles, best practices, and industry standards.
• In-depth understanding of regulatory requirements related to data protection and privacy.
• Strong leadership skills with the ability to motivate and inspire a diverse team
• Excellent communication and interpersonal skills, with the ability to communicate complex technical concepts to non-technical stakeholders.
• Strategic thinker with the ability to align security initiatives with business goals.
• Analytical and problem-solving skills to assess risks and devise effective solutions.
• Experience in budgeting and resource management for security initiatives.
• Leadership qualities, including strategic thinking, influencing, decision-making, and problem-solving abilities.
• Relevant certifications such as…