Total 7 information technology job vacancies in Legal / Public / Security category in GB London Riverbank House

Protect and assure patient data and services against cyber security risk, while enabling secure delivery of new patient services and systems Provide leadership and guidance to the Trust on cyber security policy, risk and compliance issues Provide leadership and support to the Cyber Security Risk Manager and team Deputise for the Head of Information Security when required Develop and drive adoption of the Trusts cyber security strategy, policy, standards and procedures, including policy exception management, in alignment with Trust strategic objectives and with legal and NHS Digital requirements for cyber security and data protection Development of cyber security portfolio, including alignment with clinical and IT strategic objectives and initiatives Partner with business and IT leaders and key decision makers to ensure that appropriate cyber security controls are deployed and operated to time and budget Develop and ensure delivery of the Trust strategic cyber improvement programme, including engagement with NHS Digital and other key partners to drive improvements in cyber capability and maturity Shape commercially acceptable business cases and propositions for Cyber Security investment which balance cyber security risk control with accessibility, usability and cost considerations Lead for providing formal response to cyber security compliance elements of the NHS Digital Data Security & Protection Toolkit Develop and drive adoption of the Trust security risk and assurance framework Lead for embedding cyber risk and assurance controls within development lifecycle for Trust services and systems Provide direction and assurance for cyber security service development and operation, including assurance on cyber security services and systems provided by suppliers Lead the Trust response to major cyber incidents, and on preparatory work for major incidents, including cyber resilience planning and rehearsals Assess and report on cyber security risk posture and compliance through specification and collection of relevant cyber security metrics and KPIs Ensure that the Trust can meet the requirements of national cyber security standards and legislation, including the Data Security & Protection Toolkit, Cyber Essentials Plus, the Data Protection Act (2018) / GDPR and the Directive on the security of Network and Information Systems Monitor and audit Trust processes to identify gaps or weaknesses in current policy and practice, for manual and or electronic systems. Ensure all recommendations are implemented to deliver a continuous improvement in Trust service delivery Agree an annual audit programme with the Trusts Internal Audit department and external auditors. Ensure senior Trust engagement and support for cyber initiatives through regular briefings and reports to senior management boards and forums on cyber risk posture, action planning, and compliance with required standards Provide colleague education and awareness on cyber threat and how to safely respond to cyber incidents As a member of the Trusts senior cyber security team, ensure that cyber security considerations are effectively raised and addressed within appropriate IT and business management forums Set objectives for the Cyber Security Risk team, monitoring performance to assure delivery of the cyber security work programme Develop the skills and foster the career paths for cyber security professionals within the Cyber Risk team. Responsible for overseeing information security systems in place. Reporting on security systems in place and producing reports and audits for relevant governance forums.

Leadership Provide leadership and direction to the information security and business continuity service, including wider directorate and business teams Mentor and coach others, helping to develop our long-term capability including identify capability gaps and solutions Contribute to the development of long-term strategic plans for information security and business continuity, identifying risks and issues and developing mitigation strategies with clear outcome measures.Communicating between the technical and non-technical Identify the needs of business and technical stakeholders. Effectively manage stakeholder expectations. Demonstrate excellent communication skills and can manage difficult conversations or negotiations, including highly complex, sensitive and/or contentious information. Represent information security and business continuity on various internal and external groups.Data protection and freedom of information Support information gathering and creating supporting narrative / recommendations for complex data protection and freedom of information requests. Conduct information system searches and investigations that are highly complex / sensitive in nature, to meet data protection or freedom of information needs. Provide advice and expert knowledge to projects / programmes / operational services to ensure that information systems are designed to meet data protection requirements.Financial management Understand how to balance cost versus value. Consider the impact of user needs. Contribute and develop economic investment cases for information security including financial models for implementation, and running of servicesGovernance and assurance Evolve and define governance. Take responsibility for working with and supporting other staff in wider governance. Assure services across sets of services. Use tools such as standards, guardrails, and principles to effectively govern delivery.Information Security and Business Continuity Demonstrate in-depth knowledge of information security and business continuity, including analysing + testing Trust-wide capabilities and identifying improvement areas. Ensure that our security posture is maintained, monitored/measured and be responsible for leading interventions where standards are not met (example: security patching). Develop, maintain, and improve our data and technology Business Continuity & Disaster Recovery Plans, enabling us to respond to and recover from business continuity events ensuring we can provide a safe level of service to the public during the event, and ensuring we can manage the recovery process and incorporating learning. Lead vulnerability audits, security & penetration tests, forensic audits, or related investigations ensuring all findings are evaluated, and where appropriate, fed into continuous service improvement activities to continuously improve our security posture and resilience. Responsible for ensuring standards around information security and business continuity are embedded into service design. Provide subject matter expertise in major incidents, cyber security incident and/or events caused by or affecting information security. Act as the Problem Owner for highly complex, or sensitive information security matters (from identification through to resolution). Undertake Data Protection Impact Assessment (DPIA) and Information Security Assessment (ISA) activities, including supply chain / 3rd party assessments, aligned with projects / operational services. Maintain and improve the Information Security Assessment lifecycle, and Information Risk Management documentation for IT systems and data. Ensure that access to Trust systems is appropriately managed, regularly audited, and lead investigations as required. Provide expert advice on information transfer agreements with partner organisations in support of the Information Governance function. Partner with the Organisational Development and Information Governance teams and support the delivery of information security awareness and training.Making and informing risk-based decisions Make decisions characterised by managed levels of risk and complexity and recommend decisions as risk and complexity increase. Resolve disputes between wider peers and indirect stakeholders, considering all views and opinions.Policies, procedures, and processes Develop, maintain, and improve all directorate information security and business continuity policies & procedures, considering regional and national policies and practices, ensuring that both manual and electronic information across the Trust is included in-scope. Including, but not limited to DSPT, NIS, ISO / IEC series standards, cyber essentials, etc.Risk management Conduct information security risk assessments and control selection activities. Responsible for the management of information security and business continuity risks (for technology and data), including identifying new risks and ensure we are actively managing risk controls (for your portfolio that you are leading on).Service focus, monitoring, and reporting See the bigger picture and investigate how to get the best out of the underlying services to support the organisations strategic objectives and business priorities. Take complex reporting data from multiple sources, compare, and interpret against service baseline and industry standards and provide a supporting narrative. Responsible for service reporting for information security and business continuity, in-line with Trust-agreed reporting measures (example: security dashboard, security operations centre performance, etc). Ensure we comply with external reporting for information security and business continuity (example: NHS Cyber Alerts).Strategy Apply strategy, using and challenging patterns, standards, policies, roadmaps, and vision statements. You can provide guidance. Evaluate current information security and business continuity strategies to ensure business requirements are being met and exceeded where possible Responsible for managing and updating underpinning / enabling information security strategies that support the business objectives Ensure alignment of operating procedures and policies in-line with national, sector (ICS) and industry best practice where it makes sense to do so.Understanding the whole context Understand trends and practices outside your team and how these will impact your work. See how your work fits into the broader strategy and historical context. Consider the patterns and interactions on a larger scale.User focus Explain the difference between user needs and the desires of the user. Champion user research to focus on all users. Prioritise and define approaches to understand the user story, guiding others in doing so. Offer recommendations on the best tools and methods to use.Community of practice Develop and maintain a network of professionals to enable continuous learning and a community which can share, learn, and keep up to date on the information security and business continuity landscape, within the wider Digital, Data and Technology teams. Other Duties: Deputise for the Head of Information Security & Business Continuity as required. Occasional work may be required outside of core business hours to support major projects / programmes. All other reasonable requests

This role is part of our Information Security & Business Continuity team, responsible for:
• Ensuring the protection of the information in our organisation throughout the information lifecycle - that ensures the confidentiality, integrity, purpose, and availability of information, so that the organisation’s information is safeguarded from unauthorized access and misuse.
• Ensuring the availability of minimum services at a sufficient level for the business to sustain in the event of disasters.
• Horizon scanning across industry, identifying emerging trends and their potential impact and opportunity for the organisation.
The team has operational responsibility for security tooling and data (examples, but not limited to – anti-virus and intrusion prevention, security assurance platforms, security testing and monitoring platforms, etc) and for our managed services (security operations centre).
You will put people at the heart of everything you do – with a relentless focus on user experience and ensuring all our user needs are met across sites at Moorfields Eye Hospital NHS Foundation Trust.
With the ever-increasing need and interest in the use of digital technology in healthcare, you will be part of a team of Digital, Data and Technology experts that delivers service improvements and keeps at the forefront of new technology.

At this role level, you will:
• Responsible practitioner for multiple information security and business continuity services that are highly complex and high risk, ensuring performance and quality measures are aligned with business outcomes, and met.
• Define strategies and be central to assuring multiple services – improving the security and resilience of our organisational infrastructure.
• Regularly collaborate and find agreement with senior stakeholders, providing direction and challenge
• Be proactive in identifying problems and translating these into non-technical descriptions that can be widely understood.
In your role you will partner with other technology and data teams in the organisation. It is expected alongside specialist information security and business continuity skills and experience, you will have generalist or specialist experience in multiple domains:
• Cloud operations
• Data management
• Domain directory services
• Data storage and management
• Datacentre operations
• Device management
• Network security and operations
• Server architecture

At Moorfields, we provide more than just an excellent career and great colleagues to work with. We also offer:
• Salary including High-Cost Area Supplement
• Opportunity to join the NHS Pension Scheme
• Free 24/7 independent counselling service
• Learning and development opportunities
• Easy and quick transport links
• A range of attractive benefits and discounts
• Access to Blue Light Card and other NHS Discount Schemes
• Free Pilates classes
• Full support and training to develop your skills
• Flexible working friendly organisation
And so much more! To see the full range of benefits we offer please see our Moorfields benefits document.

Leadership
• Provide leadership and direction to the information security and business continuity service, including wider directorate and business teams
• Mentor and coach others, helping to develop our long-term capability including identify capability gaps and solutions
• Contribute to the development of long-term strategic plans for information security and business continuity, identifying risks and issues and developing mitigation strategies – with clear outcome measures.
Communicating between the technical and non-technical
• Identify the needs of business and technical stakeholders.
• Effectively manage stakeholder expectations.
• Demonstrate excellent communication skills and can manage difficult conversations or negotiations, including highly complex, sensitive and/or contentious information.
• Represent information security and business continuity on various internal and external groups.
Data protection and freedom of information
• Support information gathering and creating supporting narrative / recommendations for complex data protection and freedom of information requests.
• Conduct information system searches and investigations that are highly complex / sensitive in nature, to meet data protection or freedom of information needs.
• Provide advice and expert knowledge to projects / programmes / operational services to ensure that information systems are designed to meet data protection requirements.
Financial management
• Understand how to balance cost versus value.
• Consider the impact of user needs.
• Contribute and develop economic investment cases for information security – including financial models for implementation, and running of services
Governance and assurance
• Evolve and define governance.
• Take responsibility for working with and supporting other staff in wider governance.
• Assure services across sets of services.
• Use tools such as standards, guardrails, and principles to effectively govern delivery.
Information Security and Business Continuity
• Demonstrate in-depth knowledge of information security and business continuity, including analysing + testing Trust-wide capabilities and identifying improvement areas.
• Ensure that our security posture is maintained, monitored/measured and be responsible for leading interventions where standards are not met (example: security patching).
• Develop, maintain, and improve our data and technology Business Continuity & Disaster Recovery Plans, enabling us to respond to and recover from business continuity events – ensuring we can provide a safe level of service to the public during the event, and ensuring we can manage the recovery process and incorporating learning.
• Lead vulnerability audits, security & penetration tests, forensic audits, or related investigations – ensuring all findings are evaluated, and where appropriate, fed into continuous service improvement activities to continuously improve our security posture and resilience.
• Responsible for ensuring standards around information security and business continuity are embedded into service design.
• Provide subject matter expertise in major incidents, cyber security incident and/or events caused by or affecting information security.
• Act as the Problem Owner for highly complex, or sensitive information security matters (from identification through to resolution).
• Undertake Data Protection Impact Assessment (DPIA) and Information Security Assessment (ISA) activities, including supply chain / 3rd party assessments, aligned with projects / operational services.
• Maintain and improve the Information Security Assessment lifecycle, and Information Risk Management documentation for IT systems and data.
• Ensure that access to Trust systems is appropriately managed, regularly audited, and lead investigations as required.
• Provide expert advice on information transfer agreements with partner organisations in support of the Information Governance function.
• Partner with the Organisational Development and Information Governance teams and support the delivery of information security awareness and training.
Making and informing risk-based decisions
• Make decisions characterised by managed levels of risk and complexity and recommend decisions as risk and complexity increase.
• Resolve disputes between wider peers and indirect stakeholders, considering all views and opinions.
Policies, procedures, and processes
• Develop, maintain, and improve all directorate information security and business continuity policies & procedures, considering regional and national policies and practices, ensuring that both manual and electronic information across the Trust is included in-scope. Including, but not limited to – DSPT, NIS, ISO / IEC series standards, cyber essentials, etc.
Risk management
• Conduct information security risk assessments and control selection activities.
• Responsible for the management of information security and business continuity risks (for technology and data), including identifying new risks and ensure we are actively managing risk controls (for your portfolio that you are leading on).
Service focus, monitoring, and reporting
• See the bigger picture and investigate how to get the best out of the underlying services to support the organisations’ strategic objectives and business priorities.
• Take complex reporting data from multiple sources, compare, and interpret against service baseline and industry standards and provide a supporting narrative.
• Responsible for service reporting for information security and business continuity, in-line with Trust-agreed reporting measures (example: security dashboard, security operations centre performance, etc).
• Ensure we comply with external reporting for information security and business continuity (example: NHS Cyber Alerts).
Strategy
• Apply strategy, using and challenging patterns, standards, policies, roadmaps, and vision statements. You can provide guidance.
• Evaluate current information security and business continuity strategies to ensure business requirements are being met and exceeded where possible
• Responsible for managing and updating underpinning / enabling information security strategies that support the business objectives
• Ensure alignment of operating procedures and policies in-line with national, sector (ICS) and industry best practice – where it makes sense to do so.
Understanding the whole context
• Understand trends and practices outside your team and how these will impact your work.
• See how your work fits into the broader strategy and historical context.
• Consider the patterns and interactions on a larger scale.
User focus
• Explain the difference between user needs and the desires of the user.
• Champion user research to focus on all users.
• Prioritise and define approaches to understand the user story, guiding others in doing so.
• Offer recommendations on the best tools and methods to use.
Community of practice
• Develop and maintain a network of professionals to enable continuous learning and a community which can share, learn, and keep up to date on the information security and business continuity landscape, within the wider Digital, Data and Technology teams.
Other Duties:
• Deputise for the Head of Information Security & Business Continuity as required.
• Occasional work may be required outside of core business hours to support major projects / programmes.
• All other reasonable requests


This advert closes on Wednesday 13 Nov 2024

Information Security & Compliance Officer

£33K to £45K plus LWA of £6,707 to £8,164 (only applicable in London)

Onsite/Hybrid working - London or Glasgow based

Permanent opportunity

My client are a leading Charity organisation who is seeking an experienced Information Security and Compliance Officer to join their IT team. This critical role will be responsible for maintaining information security policies and controls, conducting security reviews, and ensuring the protection of all information security assets.

Key Responsibilities:

• Work closely with the Head of IT and Data Protection Officer to provide security guidance for IT and departmental projects.
• Design and implement security standards, policies, guidelines, and architectural principles to meet the organisation's cyber security goals.
• Develop and implement data loss prevention (DLP) policies, data retention, classification, and archiving processes.
• Support the Data Protection Officer with data breach incidents and subject access request tasks.
• Audit external platforms and ensure they meet the organisation's security standards.
• Be part of the Cyber Security Incident Response team and respond to security inquiries.
• Promote cyber security awareness through training and internal phishing campaigns.
• Perform security and user permissions audits, organise penetration testing, and ensure corrective actions are taken.
• Monitor core platforms, network infrastructure, and systems for unusual activity and insider threats.

Qualifications and Experience:

• Degree-level education.
• Certified in CISSP or CISM, or working towards certification.
• Strong understanding of IT networking, firewalls, protocols, and access management concepts.
• Broad knowledge of various IT systems, including cloud computing platforms (Microsoft 365 and Azure), with a deep understanding of associated security risks.
• Experience working with and deploying SIEM and CASB systems, intrusion detection/prevention, and Microsoft conditional access policies.
• Familiarity with information security principles and best practices (e.g., ISO27001, ISF Standards of Good Practice for Information Security).
• Understanding of and practical experience with GDPR, Freedom of Information Act, and related legislation.
• Ability to present security topics to non-technical audiences and communicate business and technical risks effectively.
• Self-motivated and proactive approach.

Morgan Hunt is a multi-award-winning recruitment business for interim, contract and temporary recruitment and acts as an Employment Agency in relation to permanent vacancies. Morgan Hunt is an equal opportunities employer. Job suitability is assessed on merit in accordance with the individual's skills, qualifications and abilities to perform the relevant duties required in a particular role.

Morgan Hunt are currently working with a Large National Charity in their search for an interim National Information Security Manager to oversee Information Governance & Security arrangements across the organisation.

You will act as a first point of contact for any information security enquiries, as well as ensuring the organisation maintains ISO27001:2013 accreditation.

This will involve coordinating external and conducting internal audits, managing a risk register, coordinating business continuity plans, updating the Information Security Manual, and any other tasks associated with this.

You will a transition to the new ISO27001:2022 standard as soon as possible, as well as coordinate Cyber Essentials certification renewals and Data Security Protection Toolkit submissions on an annual basis. You will also advise on, and support in, the drafting of information security policy documents, guidance, training, and other related documents.

The successful post-holder will have strong experience in an Information Governance/Information Security Manager position within the Public Sector, alongside recognised qualifications.

You will have a good understanding of the ISO27001 series of controls standards, knowledge of Data Security Protection Toolkit requirements and experience conducting audits.

You will have experience utilising quality management systems, strong analytical skills alongside excellent communication skills (written and verbal).

Job Title: National Information Security Manager

Location: Remote (Ad Hoc Travel to Offices)

Annual Salary: £52,500 - £57,000

Job Type: Fixed Term Contract (6 month, potential extension)

Hours: Full-Time (37.5 hours per week)

Key Responsibilities

• Manage re-certification of ISO27001 and Cyber Essentials accreditations, undertaking and coordinating tasks necessary for certification
• Coordinate annual submission of Data Security Protection Toolkit and associated manage tasks
• Alongside Legal Services colleagues, log, monitor and investigate data breaches
• Coordinate annual reviews of internal Data Protection and Information Security eLearning package
• Represent information security interests across a range of meetings, both internal and external (including attending regular Technology Department meetings, and organisational governance groups)
• Advise the organisation on information security impacts of new projects or process changes as well as supporting completion of data protection impact assessments
• Conduct and support internal audits on information security measures at Regional Business Units and operational services

Person Specification

• At least 2 years of full-time work experience in information security management and/or related functions (such as IT audit and IT Risk Management)
• A recognised Information security management qualification/s
• Experience in writing formal letters and reports as well as knowledge of general legal practices
• Good understanding of the ISO27001 series of controls standards
• Experience of governance and national connectivity programs as well as using quality management systems
• Experience of auditing, project development and project management
• Ability to analyse data, cross referencing with other data sources and intelligence in order to offer conclusions
• Experience in policy writing and stakeholder management skills
• Knowledge of the health, social care and third sector

Please contact to find out more information regarding this fantastic opportunity for a National Information Security manager.

Morgan Hunt is a multi-award-winning recruitment business for interim, contract and temporary recruitment and acts as an Employment Agency in relation to permanent vacancies. Morgan Hunt is an equal opportunities employer. Job suitability is assessed on merit in accordance with the individual's skills, qualifications and abilities to perform the relevant duties required in a particular role.

Information Security Officer

In order to strengthen the delivery organisation, ING Luxembourg is looking for an Information Security Officer on a temporary contract bases.

Job description :

Your mission will be to reinforce a team of Security Officers in order to maintain the bank within its IT risk appetite and participate in the implementation of the DORA regulation. Taking part in several key security activities in close collaboration with the other Security Officers and Tech department.

To achieve this, the Information Security Officer main responsibilities are to: 

• Support the implementation of new IT regulations such as DORA, by performing gap analysis, action plan definition, implementation support and/or follow-up;
• Participate with the second line of defence and local stakeholders in local and third parties risk assessments activities: assessing threats, mitigating controls, proposed controls, and their risk levels risk (Inherent, current and residual);
• Collaborate with IT teams to ensure the integration of security measures in system designs and implementations;
• Take part in the day-to-day IT security operations (digital certificate issuing, Non Personal account support, incident reports, incident management, etc.);
• Follow-up and support security controls implementation the different IT Risk security domains: Foundations, Identity and Access Management, Change Management, Platform Security, Operational Resilience and Security Monitoring;
• Take part in internal and external Audits;
• Support other Security officers in their various activities;
• Work with highly collaborative agile teams;
• Maintain good working relations with the other bank teams;

Your profile 

Competencies/Behaviour :

• Ability to take initiatives and responsibilities;
• Ability to adapt and anticipate;
• Effective communication skills to convey security concepts to technical and non-technical stakeholders;
• Rigor, precision;
• Customer/result orientation;
• Strong team spirit;
• Ability to learn and transmit it;
• Stay updated on emerging threats and security technologies to proactively enhance the organization’s security posture;
• Knowledge of banking environment is appreciated;

Skills :

• Knowledge of security frameworks, standards, and best practices, such as ITIL, ISO27001, OWASP and PCI-DSS;
• Experience with standard Security components: Firewalls, proxies, DLP, Anti-virus, WAF, SIEM, etc;
• Experience with third party contract management;
• Experience with regulatory requirements analysis;
• Experience with standard enterprise tools: Office suite, ServiceNow, CMDB tools, etc.;
• Scripting knowledge to automate recurring tasks, such as Perl, Python, etc.;
• Knowledge of standard developments practices and tooling such as GIT and Azure pipeline;

Expérience :

• Master degree in IT Security, IT Risk management or related domains;
• At least 5 years of experience in IT Security related job (IT security officer, Information Risk Manager, IT Security governance consultant, etc.);
• Related certifications such as CISSP, CISM or similar experience;

Languages:

• A good knowledge of English and a conversational knowledge of French are required;

Your working environment

With over 1000 employees in the Grand Duchy and thanks to the combination of our local presence and the strength of a robust multinational like ING, we offer our personal and business customers a wide range of solutions through the channel of their choice.
ING is a global bank with a strong European base. 53,000 employees serve around 38.4 million customers, corporate clients and financial institutions in over 40 countries. Operating in the Grand Duchy of Luxembourg since 1960 as a universal and accessible bank, our products include savings, payments, investments, loans and mortgages for retail and private banking customers, whom we sever serve online and through our network of branches. For our Wholesale Banking clients, we provide lending, sustainable finance, payment & cash management and fund services.

Report or escalate issues as appropriate to the Information and Cyber Security Manager. Produce reports for cyber security operations, including agreed service levels, KPI's and standards where applicable. Assess the effectiveness of Security Controls by conducting reviews, internal audits and spot-checks of ICT Security Infrastructure elements including: firewall, IDS/IPS, anti-malware, web and email filtering, MDM, SIEM, patch and vulnerability management. For a detailed job description and main responsibilities, please see the full Job Description and Person Specification.