Information Security and Compliance Manager

I am currently working with a Charity who are seeking a Head of Information Security and Compliance. You will join an ambitious, focused and dynamic team who are passionate about how technology can enable our staff to deliver incredible support to the armed forces community.

Role Purpose:
The Information Security and Compliance Manager is responsible for developing, implementing, and maintaining security policies, procedures, and controls to protect the data and systems. They will play a pivotal role in the management and containment of security incidents, ensuring continuous improvement in their security posture while raising awareness for staff, volunteer and member communities. The post holder will lead on activities that assess, report and mitigate risk associated with third parties with the focus being to protect the confidentiality, integrity, and availability of information assets.

Key Responsibilities:
Information Protection

• Take responsibility for their information and data protection policies, practices and settings to include sensitivity labels, data retention policies and data loss protection policies
• Collaborate with the Head of Risk, DPO and VCISO to identify and manage information security risks and mitigating controls
• Lead the wider business areas to ensure security policies and procedures are embedded in all business processes.
• Take an active role in in the containment and reporting of information security incidents, including detection, response, remediation and communication.

Third Party risk management

• Lead on the design and implementation of robust processes for reviewing & addressing the data security posture of third-party suppliers.
• Take a leading role in managing relationships with vendors and service providers to assess compliance with security and data protection policies and standards.

Policy, Audit & Reporting

• Take the lead on the review process for information security policies working to agreed re-view schedules. Ensure all policies are published and made available to all staff and volunteers increasing awareness among these groups.
• Develop policies and procedures in accordance with industry regulations and standards such as Data Protection Act 2018, PCI-DSS, and ISO27001.
• Monitor tools for data governance, data security, and compliance to manage information security risks and regulatory requirements and detect and investigate possible information security incidents.

Knowledge & Experience

• Significant proven experience in information security and compliance management.
• Familiarity with ITIL practices and risk management methodologies.
• Significant proven experience with cyber security incident management and response
• Strong knowledge of security standards and regulations, such as GDPR, PCI-DSS, and ISO27001
• Experience of delivering data protections specifically data loss prevention, sensitivity labelling and retention (using Microsoft Purview)
• Experience of managing projects through to completion

Skills & Attributes

• Excellent problem-solving skills and the ability to provide technical expertise and advice - Strong all round technical skills
• Strong communication and collaboration skills & proven ability to work effectively with various departments including senior leaders.
• Ability to explain technical solutions to a non-technical audience
• Ability to manage and organise own workload and be flexible and ready to adapt to changing demands
• Strong analytical skills with the proven ability to (use) on the data available to inform decisions and actions

Qualifications
Certified in one of the following:

• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified Information Systems Auditor (CISA)
• Certified in Risk and Information Systems Control (CRISC)