Data Protection and Security Specialist

**Information Security Manager Position Summary**

This position is responsible for defining and embedding best practice information security policies, standards, and processes based on ISO 27001. The successful candidate will maintain our ISO 27001 certification, provide security architecture advice and guidance to technical teams, manage and deliver new information security programs.

The ideal candidate will have a minimum of 5 years' experience working in information security, with a good understanding of managing an ISO 27001 Information Security Management System, GDPR, and Data Privacy Impact Assessment.

**Key Responsibilities**

• Lead on compliance reviews, certifications, and accreditations (e.g., ISO 27001, GDPR, third-party supplier & client).
• Complete security threat and risk assessments, monitor the risk treatment plan, and perform security assessments/reviews on complex information systems.
• Implement relevant Governance, Risk, and Compliance (GRC) controls and measures to protect systems and data.
• Verify current digital solutions and processes are in line with current policies and in line with modern secure technologies.
• Enhance existing and create new information security policies, standards, and guidelines.
• Contribute to the development of digital strategies to address information security risks.
• Work with business, internal IT, and 3rd party vendor teams to promote and adopt security best practices.
• Provide information security support to current and future IT projects.
• Manage Information Security Audits within the scope of the ISMS and from our own Internal Audit team, clients, and third parties.

**Security Awareness and Training**

• Manage the development of Information Security Awareness programs and in-house security awareness training and security communications.

**Technical Requirements**

• Carry out security architecture reviews to ensure defence in depth, security by design is implemented and where required to support privacy by design.
• Knowledge of Zero-trust technologies and architectures.
• Working knowledge of the latest security designs for Microsoft environments including Azure, M365, Power Platform, and CoPilot services.
• Working knowledge of the software development lifecycle within the enterprise organisation.
• An understanding of how to securely integrate data flows between different systems.
• Develop and create security hardening standards to secure our systems.

**Requirements and Qualifications**

• Good knowledge of managing an ISO 27001 Information Security Management System.
• Minimum 5 years' experience working in information security.
• Understand GDPR and Data Privacy Impact Assessment.
• Monitoring and reporting on compliance with security and data protection policies, as well as the enforcement of policies.
• Good understanding of Microsoft M365, Power Platform, CoPilot, and Azure security.
• Understand secure design architecture and principles.
• Ability to triage security incidents.
• Ability to carry out technical security audits.
• Ability to carry out security architecture reviews.

**Personal Specification**

• Demonstrate pro-active, personal responsibility and demonstrate ability to operate with autonomy.
• Strong work ethic.
• Good communications skills, both verbal and written, and the ability to work within a multi-discipline team environment.
• Ability to produce accurate, high-quality work to strict project deadlines.
• Flexibility and willingness for limited travel.
• Strong organisational and project management skills.
• Ability to plan and manage projects.
• Interest in learning new and developing technologies.