Job Description

Job Title: IT Information Security Manager
Department: Finance
Location: Any company site in the UK
Responsible To: Head of IT
Salary: Up to £79,000

Job Purpose

The IT Information Security Manager will provide day to day management of the technical cyber security environment, SOC and be responsible for information security management. This hands-on role has overall responsibility to ensure appropriate levels of cyber security controls, working alongside other internal teams outside of IT, to ensure ongoing best practice & compliance. This role has one direct report: IT Sec Ops engineer.

Specific Statutory Details

Under sections 7 & 8 of the Health and Safety at Work Act, it is the duty of every employee while at work:

• To take reasonable care for the health and safety of himself/herself and of other persons who may be affected by his/her acts or omissions at work;
• To co-operate with his/her employer to enable compliance with any safety instructions;
• Not to interfere with, or misuse equipment provided to meet the employer’s safety procedures.
• Duty of care under common law.

Key Accountabilities

• 5+ years exp Cyber Security Manager, Cyber Risk Manager, Cyber Threat Manager, Information Security Manager, IT Security Manager or similar
• Working with the Head of IT to create, maintain, and deliver a robust Cyber Security Roadmap to minimise risk
• Own and maintain all Security related policies and procedures
• Implement “Security by Design”
• Drive a culture of IT & Cyber Security awareness and responsibility
• Develop and maintain the Information Security Strategy
• Conduct ongoing security threat, risk, capability &/or maturity assessments
• Experience & understanding of security legislation, regulatory frameworks, security methodologies & industry standards
• Extensive experience with GDPR and data protection
• Experience setting up and running of SOC services
• Management of a 3rd party SOC
• Experience conducting and responding to Audits
• Experience implementing ISO 27001
• Knowledge of security assessment frameworks (eg threat modelling, controls assessment, risk assessment)
• Responsibility to deal with any security incidents in prompt timeframes, overseeing technical solutions to address specific security challenges & mitigation
• Solid understanding of IT infrastructure fundamentals such as networks, operating systems & databases
• Engage & collaborate with third party vendors, to ensure capacity of retained specialist resource eg IT forensic analysis, penetration testing, security auditing etc
• Experience with Rapid 7, Sophos MTR, Solarwinds and SNOW
• Excellent reporting skills
• Other duties and experience including but not restricted to: Info Sec Strategy, Vulnerability Management and Pen testing scheduling and remediation, Threat Intelligence, Incident management and playbooks, PCI DSS, NIS, Patch management, Azure / O365

Personal Specification

• Professional Security Qualifications – e.g., CISSP, CRISM, CISM Security+ etc
• Significant prior experience in an Information Security role, both from a strategy/framework management level and security controls deployment oversight
• Advanced/expert knowledge of Industry Information Security Standards such as ISO, NIST
• Experience of mapping an organisations current operations vs these standards, analysis of gaps the delivery required to close them.
• Willing to travel
• CTC Clearance
• Full clean driving licence