Protect and assure patient data and services against cyber security risk, while enabling secure delivery of new patient services and systems Provide leadership and guidance to the Trust on cyber security policy, risk and compliance issues Provide leadership and support to the Cyber Security Risk Manager and team Deputise for the Head of Information Security when required Develop and drive adoption of the Trusts cyber security strategy, policy, standards and procedures, including policy exception management, in alignment with Trust strategic objectives and with legal and NHS Digital requirements for cyber security and data protection Development of cyber security portfolio, including alignment with clinical and IT strategic objectives and initiatives Partner with business and IT leaders and key decision makers to ensure that appropriate cyber security controls are deployed and operated to time and budget Develop and ensure delivery of the Trust strategic cyber improvement programme, including engagement with NHS Digital and other key partners to drive improvements in cyber capability and maturity Shape commercially acceptable business cases and propositions for Cyber Security investment which balance cyber security risk control with accessibility, usability and cost considerations Lead for providing formal response to cyber security compliance elements of the NHS Digital Data Security & Protection Toolkit Develop and drive adoption of the Trust security risk and assurance framework Lead for embedding cyber risk and assurance controls within development lifecycle for Trust services and systems Provide direction and assurance for cyber security service development and operation, including assurance on cyber security services and systems provided by suppliers Lead the Trust response to major cyber incidents, and on preparatory work for major incidents, including cyber resilience planning and rehearsals Assess and report on cyber security risk posture and compliance through specification and collection of relevant cyber security metrics and KPIs Ensure that the Trust can meet the requirements of national cyber security standards and legislation, including the Data Security & Protection Toolkit, Cyber Essentials Plus, the Data Protection Act (2018) / GDPR and the Directive on the security of Network and Information Systems Monitor and audit Trust processes to identify gaps or weaknesses in current policy and practice, for manual and or electronic systems. Ensure all recommendations are implemented to deliver a continuous improvement in Trust service delivery Agree an annual audit programme with the Trusts Internal Audit department and external auditors. Ensure senior Trust engagement and support for cyber initiatives through regular briefings and reports to senior management boards and forums on cyber risk posture, action planning, and compliance with required standards Provide colleague education and awareness on cyber threat and how to safely respond to cyber incidents As a member of the Trusts senior cyber security team, ensure that cyber security considerations are effectively raised and addressed within appropriate IT and business management forums Set objectives for the Cyber Security Risk team, monitoring performance to assure delivery of the cyber security work programme Develop the skills and foster the career paths for cyber security professionals within the Cyber Risk team. Responsible for overseeing information security systems in place. Reporting on security systems in place and producing reports and audits for relevant governance forums.

Leadership Provide leadership and direction to the information security and business continuity service, including wider directorate and business teams Mentor and coach others, helping to develop our long-term capability including identify capability gaps and solutions Contribute to the development of long-term strategic plans for information security and business continuity, identifying risks and issues and developing mitigation strategies with clear outcome measures.Communicating between the technical and non-technical Identify the needs of business and technical stakeholders. Effectively manage stakeholder expectations. Demonstrate excellent communication skills and can manage difficult conversations or negotiations, including highly complex, sensitive and/or contentious information. Represent information security and business continuity on various internal and external groups.Data protection and freedom of information Support information gathering and creating supporting narrative / recommendations for complex data protection and freedom of information requests. Conduct information system searches and investigations that are highly complex / sensitive in nature, to meet data protection or freedom of information needs. Provide advice and expert knowledge to projects / programmes / operational services to ensure that information systems are designed to meet data protection requirements.Financial management Understand how to balance cost versus value. Consider the impact of user needs. Contribute and develop economic investment cases for information security including financial models for implementation, and running of servicesGovernance and assurance Evolve and define governance. Take responsibility for working with and supporting other staff in wider governance. Assure services across sets of services. Use tools such as standards, guardrails, and principles to effectively govern delivery.Information Security and Business Continuity Demonstrate in-depth knowledge of information security and business continuity, including analysing + testing Trust-wide capabilities and identifying improvement areas. Ensure that our security posture is maintained, monitored/measured and be responsible for leading interventions where standards are not met (example: security patching). Develop, maintain, and improve our data and technology Business Continuity & Disaster Recovery Plans, enabling us to respond to and recover from business continuity events ensuring we can provide a safe level of service to the public during the event, and ensuring we can manage the recovery process and incorporating learning. Lead vulnerability audits, security & penetration tests, forensic audits, or related investigations ensuring all findings are evaluated, and where appropriate, fed into continuous service improvement activities to continuously improve our security posture and resilience. Responsible for ensuring standards around information security and business continuity are embedded into service design. Provide subject matter expertise in major incidents, cyber security incident and/or events caused by or affecting information security. Act as the Problem Owner for highly complex, or sensitive information security matters (from identification through to resolution). Undertake Data Protection Impact Assessment (DPIA) and Information Security Assessment (ISA) activities, including supply chain / 3rd party assessments, aligned with projects / operational services. Maintain and improve the Information Security Assessment lifecycle, and Information Risk Management documentation for IT systems and data. Ensure that access to Trust systems is appropriately managed, regularly audited, and lead investigations as required. Provide expert advice on information transfer agreements with partner organisations in support of the Information Governance function. Partner with the Organisational Development and Information Governance teams and support the delivery of information security awareness and training.Making and informing risk-based decisions Make decisions characterised by managed levels of risk and complexity and recommend decisions as risk and complexity increase. Resolve disputes between wider peers and indirect stakeholders, considering all views and opinions.Policies, procedures, and processes Develop, maintain, and improve all directorate information security and business continuity policies & procedures, considering regional and national policies and practices, ensuring that both manual and electronic information across the Trust is included in-scope. Including, but not limited to DSPT, NIS, ISO / IEC series standards, cyber essentials, etc.Risk management Conduct information security risk assessments and control selection activities. Responsible for the management of information security and business continuity risks (for technology and data), including identifying new risks and ensure we are actively managing risk controls (for your portfolio that you are leading on).Service focus, monitoring, and reporting See the bigger picture and investigate how to get the best out of the underlying services to support the organisations strategic objectives and business priorities. Take complex reporting data from multiple sources, compare, and interpret against service baseline and industry standards and provide a supporting narrative. Responsible for service reporting for information security and business continuity, in-line with Trust-agreed reporting measures (example: security dashboard, security operations centre performance, etc). Ensure we comply with external reporting for information security and business continuity (example: NHS Cyber Alerts).Strategy Apply strategy, using and challenging patterns, standards, policies, roadmaps, and vision statements. You can provide guidance. Evaluate current information security and business continuity strategies to ensure business requirements are being met and exceeded where possible Responsible for managing and updating underpinning / enabling information security strategies that support the business objectives Ensure alignment of operating procedures and policies in-line with national, sector (ICS) and industry best practice where it makes sense to do so.Understanding the whole context Understand trends and practices outside your team and how these will impact your work. See how your work fits into the broader strategy and historical context. Consider the patterns and interactions on a larger scale.User focus Explain the difference between user needs and the desires of the user. Champion user research to focus on all users. Prioritise and define approaches to understand the user story, guiding others in doing so. Offer recommendations on the best tools and methods to use.Community of practice Develop and maintain a network of professionals to enable continuous learning and a community which can share, learn, and keep up to date on the information security and business continuity landscape, within the wider Digital, Data and Technology teams. Other Duties: Deputise for the Head of Information Security & Business Continuity as required. Occasional work may be required outside of core business hours to support major projects / programmes. All other reasonable requests

Hours:

Salary:

£48,050 Per Annum

Closing Date:

Wed, 13 Nov 2024

We are seeking an experienced, skilled and motivated Information Security Specialist to join our dynamic Information Security team. As an Information Security Specialist, you will be responsible for policy development, standards implementation, compliance management, risk management, security testing and promoting positive security culture and behaviours across Skipton Building Society.

About Skipton Building Society

At Skipton Building Society we are not just another Financial Services Institution, we are a mutual organisation, which means we are owned by our members and believe in placing them at the heart of everything we do. The same goes for our people. We can only be successful as a business if we have great people.

We’re committed to creating a diverse and inclusive workplace where every colleague has an opportunity to fulfil their career potential. We respect and appreciate the value that our colleagues’ unique differences can bring and offer consideration for anyone seeking a more flexible work-life balance. Our colleagues say Skipton's a great place to work, and you could be one of them, bringing with you new ideas on how we can keep customers at the heart of what we do.

Whatever your background, and whatever your goals, we'll help you take the next step towards a better future.

What Will You Be Doing?

• Developing, reviewing, and maintaining our information security policies, standards and procedures in alignment with industry and regulatory frameworks such as ISO27001 and NIST.

• Collaborating with stakeholders to ensure policies and standards reflect industry best practices and comply with regulatory requirements.

• Serving as a subject matter expert and trusted advisor on information security, providing guidance and recommendations across the business

• Monitoring and measuring our security control effectiveness based on thorough, scheduled testing throughout the Society.

• Supporting risk assessments and audits to identify areas of non-compliance and providing recommendations for remediation.

• Maintaining and improving our internal vulnerability management schedule.

• Working with our trusted, independent partners to manage scheduled penetration testing of our critical infrastructure and applications.

• Supporting third-party security risk assessments, including due diligence, vendor onboarding, and ongoing monitoring.

• Collaborating with internal teams to provide guidance and support on information security matters, including security behaviours and culture training and incident response.

What Do We Need From You?

Knowledge:

• Proficiency in creating and maintaining information security policies and procedures to a high-quality standard.

• Strong, practical knowledge and experience with ISO27001 and NIST frameworks, including implementation and compliance analysis.

• A good understanding of regulatory requirements, such as GDPR, PRA/FCA, PCI DSS etc.

• Broad and comprehensive knowledge of common information security technologies,tools, and best practices (i.e. Microsoft Azure, Vulnerability Management, Incident Management, Risk Analysis, Security Awareness and Training etc.)

• Understanding of using emerging cyber threats to drive a continuous security improvement program.

Experience:

• A minimum of four years in an information security role or a similar position is required.

• Proven expertise in risk management and responding to cybersecurity incidents.

• Extensive experience with vulnerability management and conducting penetration testing programs, including the use of tools like Qualys or Tenable.

• Demonstrated skill in monitoring and evaluating the effectiveness of security controls against standards.

• Exceptional analytical and problem-solving abilities, capable of assessing risks and formulating practical solutions.

• Experience in creating and implementing a robust security behavior and culture program.

• Prior experience in managing third-party supplier risk is also necessary.

Behaviours:

• Strong written and verbal communication skills with an ability to interact with stakeholders at all levels of the business.

• Motivated, self-directed with the ability to work effectively and efficiently without extensive supervision.

• A creative and proactive approach to continuous learning and professional development.

Qualifications:

• Degree in Cybersecurity, Information Technology or a related field (or equivalent experience)

• Relevant certifications such as CISM, CISSP, ISO27001 Lead Implementer/Auditor or similar

Why Work For Us?

Skipton values work/life balance and we are proud to support hybrid and flexible working, where possible. We have a newly refurbished head office which offers a vibrant and collaborative working space.

We have a range of other benefits available to you including:

• Annual discretionary bonus scheme

• 25 days standard annual leave + bank holidays + rising 1 day per year of service to a maximum of 30 days.

• Holiday trading scheme allowing you to buy and sell additional annual leave days.

• Matching employer pension contribution (up to 10% per annum)

• Colleague mortgage (conditions apply)

• Salary sacrifice scheme for hybrid & electric car

• Private medical insurance for all our colleagues

• 3 paid volunteering days per annum

• A commitment to training and development.

• We care about your health and wellbeing – we provide a range of benefits that support this including cycle to work initiative and discounted gym membership.

• Diverse and inclusive colleague networks available for you to join including our Carers and Pride Alliance groups.

Due to the importance of this vacancy, we will be conducting interviews with suitable candidates before the application closure date. There will be a telephone interview where you get to find out more about the role and then a second stage interview with the hiring team which will be competency based with a choice of presentation.

Responsibilities

• Performing information risk assessments for new/existing projects, IT outsourcing security reviews, and 3rd party risk assessments as identified across all aspects of the information technology structure.
• Provide security consultations to internal customers by identifying possible security threats and determining the best security measures.
• Communicate security risks and recommendations to technical and non-technical stakeholders.
• risk assessment/application security experience
• Any other ad hoc duties as assigned by supervisor

Qualifications

• Bachelor's degree in Computer Science, Information Security, or a related field.
• Strong knowledge of software development and security practices.
• Familiarity with security standards such as OWASP, PCI DSS, and ISO 27001.
• Certifications in CISSP, CSSLP, OSCP, CISA or CEH.

Interested applicants, please email your resume to Andre Chua Jing Ming

Email: andrechua@recruitexpress.com.sg

CEI Reg No: R1989053

EA Licence No: 99C4599

Recruit Express Pte Ltd

As an Information Security Engineer, you will play a crucial role in our Security Operations Center. Your responsibilities will include monitoring, detecting, investigating, analyzing, and responding to security events within our IT infrastructure, including Operational Technology (OT) systems. Your expertise in cybersecurity frameworks, risk management, and incident response protocols will help fortify our defenses. A thorough understanding of Operational Technology security principles is essential, as you will oversee the integration of security practices in both IT and OT environments to protect our critical infrastructure. You will also apply Scaled Agile Scrum methodologies to coordinate technical meetings and manage security projects efficiently.

Roles and Responsibilities

• Design and implement advanced security architectures for IT and OT environments to ensure robust protection against emerging threats.
• Lead the development and integration of custom security solutions tailored to the specific needs of our digital and physical infrastructures.
• Conduct high-level vulnerability assessments and penetration testing to evaluate the security of IT and OT systems.
• Develop and refine incident response strategies to enhance our ability to respond to and recover from security breaches swiftly and effectively.
• Collaborate with IT and OT teams to ensure seamless integration of security technologies across all platforms.
• Serve as the technical lead on projects involving cybersecurity technologies, ensuring compliance with industry standards and regulatory requirements.
• Mentor junior engineers and analysts, providing guidance on complex technical issues and fostering a culture of technical excellence and innovation.
• Stay current with the latest cybersecurity technologies and trends, applying this knowledge to continuously improve our security posture.
• Prepare and present detailed technical reports and security briefings to senior management, offering strategic recommendations based on your assessments and findings.

Requirements

• A master’s degree in Cybersecurity, Computer Science, Engineering, or a related field, along with significant professional experience in cybersecurity.
• Expertise in designing and managing security solutions for both IT and Operational Technology systems.
• Advanced certifications in cybersecurity such as CISSP, CISM, or GIAC, with specific training in areas like SCADA or ICS security.
• Strong leadership skills with experience in managing complex security projects and leading cross-functional teams.
• Deep understanding of regulatory compliance and security frameworks such as ISO 27001, NIST, SOC 2, and others relevant to IT and OT cybersecurity.

Interested candidates, who wish to apply for the advertised position, please email us an updated copy of your resume.

We regret that only shortlisted candidates will be notified.

EA License No.: 01C4394

By sending us your personal data and curriculum vitae (CV), you are deemed to consent to PERSOLKELLY Singapore Pte Ltd and its affiliates to collect, use and disclose your personal data for the purposes set out in the Privacy Policy available at https://www.persolkelly.com.sg/policies. You acknowledge that you have read, understood, and agree with the Privacy Policy

Our client’s success is our success. And you make it happen! 

Payment systems are complex, regulated and everchanging. We are an established market leading brand who are focused on driving client growth. We’re at the forefront of innovation punching above our weight. We’re enabling the future for our clients through innovative technology like the New Payments Platform (NPP) and open banking.    

We are an unlisted public company and one of five licensed banks in Australia with full direct connectivity and production capability across all domestic payment systems. Whilst the major banks leverage this capability for their consumer and business clients, our B2B model focuses on enabling other banks, fintech’s and corporates to deliver innovative and competitive payment and digital solutions to their clients and customers. 

We are looking for an Information Security Risk Management Lead in our Group Risk and Compliance Team.  

Reporting to the Head of Operational Risk and Compliance, the Information Security Risk Management Lead is responsible for technology risk advisory, review/challenge, oversight and monitoring over information security and data risk frameworks and how it is operationalised. 

This is a highly visible role in the business ensuring technology risks are effectively identified, assessed, managed and monitored across Cuscal. Responsibilities of the Information Security Risk Management Lead in the team’s capacity as the second line of defence under the Risk Management Framework fall into four key areas: 

1) Technology Risk Management Framework Advisory, Oversight and Monitoring 

• Ensure Information Security Risks (technology and cyber) and Data risks are adequately managed through Cuscal’s frameworks in line with regulatory requirements (e.g. CPS 234,230, CPG 235 etc.), industry best practices and operating environment in line with three lines of defence   
• Ensure line 2 risk management capability is built and sustained to review, challenge, oversight and assurance reinforcing and maturing line 1 accountability with the business owners   
• Work collaboratively with Product domains, Engineering and corporate functions to embed technology risk management practices into everyday activities, embed controls, and monitor/report on issues.  
• Foster a risk culture that promotes open communication, transparency, and ownership of risk at all levels of the organisation  
• Risk Reporting & Analytics: Provide insights derived from technology and data risk reporting to the Board and Executive Leadership Team 

2) 2nd Line Review, Challenge and Oversight 

• Review and challenge risk/RiC assessments, adequacy and effectiveness of risk mitigation strategies, controls, and action plans implemented by 1st line teams.   
• Critically assess incidents, breaches, and near misses to identify systemic issues and recommend appropriate remediation actions.  
• Ensure the continuous improvement of risk management practices by engaging with business units to provide constructive feedback and challenge assumptions.   
• Act as a trusted advisor to senior leadership and business units on operational risk matters, including emerging risks, regulatory changes, and industry trends.   
• Drive education and training programs to elevate operational risk awareness and capabilities across the organisation.   
• Collaborate with product, client, and technology teams to ensure operational risk considerations are integrated into new initiatives, system changes, and major projects.   
• Line 2 support for assessments of third-party technology risks and controls. 

3) Emerging Risks and Innovation 

• Stay informed about the latest developments in AI and other emerging technologies to proactively identify potential risks. Support Cuscal teams in rapidly adopting new technologies in a safe and controlled manner. 
• Review/provide oversight over initiatives to automate technology risk & controls monitoring processes using advanced tools and technologies.  
•  Promote a culture of innovation in risk management practices, encouraging the adoption of new approaches and technologies. 

4) Stakeholder Engagement 

• Work closely with internal and external stakeholders as required, to ensure a cohesive approach to technology risk management.  
• Develop and deliver training programs to enhance technology risk awareness and competency across Cuscal.  
• Promote and drive a positive risk culture to lift overall risk management maturity across Cuscal.   

About You 
To be successful in this position you will have the following skills and experience: 

• Bachelor’s degree in information technology, Information Systems, Risk Management, Cybersecurity, Computer Engineering, or a related field. Relevant certifications (e.g., CRISC, CISA, CISSP) are desirable. 
• Minimum of 4-6 years of experience in technology risk management within the financial services industry. 
• Strong knowledge of risk management and IT frameworks and standards such as ITIL, ISO 27001, NIST, COBIT, and relevant APRA guidelines (CPS234, CPG235, CPS230, CPS220) 
• Demonstrated experience in managing risks associated with AI, machine learning, and other emerging technologies. 
• Prior experiencing leading risk maturity uplift at another organisation within a function, business unit or risk class. 
• Strong project management skills, including planning, execution, and stakeholder management. 

What’s it like to work here? 

As well as good pay and a great culture, we back our employees by helping them work towards industry-recognised qualifications, using online learning, training modules and career planning tools for you to grow with us. We are committed to providing a diverse and inclusive workplace where the very best talent in Australia chooses to work. We support our colleagues with flexible work arrangements through our hybrid model whilst also offering a wide range of financial, lifestyle, health & wellbeing benefits. 

 
Next Step 
If you think this role is the right fit for you, we invite you to apply. Let’s explore who you are and what drives you. We’d love to share our vision for the future of payments sector. Please note candidate screening and interviews may be conducted prior to the closing date of the job advert. 
   
Cuscal does not accept unsolicited resumes from recruitment agencies and search firms. Please do not email or send unsolicited resumes to any Cuscal employee, location or address. 

MAJOR DUTIES: This is NOT an all-inclusive list.

• Initiates and implements policies and procedures required to manage sensitive compartmented information (SCI) programs and to protect SCI resources.
• Acts as resident expert on all SCI security matters.
• Functions as the technical authority in all other areas of classified security and classification guidance.
• Establishes policies and procedures for accomplishment of SCI protection and security.
• Researches, interprets, analyzes and applies Presidential Executive Orders, Director Central Intelligence Directives (DCIDs), Defense Intelligence Agency Manuals, DoD Manuals, Army / Air Force Manuals, Army Regulations / Air Force Instructions, and local Operating Instructions.
• Serves as the SCI Control Officer responsible for establishing, managing, and controlling all collateral and SCI classified information and material within the Sensitive Compartmented Information Facilities (SCIFs) affecting the Unit's mission.
• Ensures SCIFs comply with all applicable construction and physical requirements, standards, and regulations as delineated by higher headquarters.
• Works directly for the intelligence unit commander/Senior Intelligence Officer (SIO), reporting on the administration of the Special Security Office and SCI-associated security programs.
• Serves as the principal advisor to the intelligence unit commander/SIO on SCI, physical, computer, information, personnel, and administrative security.
• Manages and directs the activities and personnel of the unit Special Security Office.
• Plans and supervises work accomplished by assigned subordinates.
• Sets and adjusts short-term priorities and prepares schedules based on organization priorities and missions
• Appoints Local SCI courier officials that have a requirement to courier SCI on base and coordinates with the Defense Courier Service (DCS).
• Administers the SCI security clearance program for all assigned personnel, ensuring all required clearances are up-to-date and completed.
• Terminates or transfers SCI clearances for out-processing personnel.
• Provides oversight of unit and SSO security self-inspections and presents detailed and comprehensive reports with corrective action taken to the unit intelligence commander/SIO.
• Follows-up to ensure complete and quality resolution of discrepancies.
• Represents the intelligence unit to a variety of installation and functional areas, including national-level organizations.
• Interfaces directly with DoD, Defense Intelligence Agency, National Security Agency, Defense Intelligence Agency, US Army, US Air Force, Air Intelligence Agency, major commands, combatant commands, and other national-level agencies to evaluate, guide, and adjust unit programs to meet changing security needs and requirements as personally assessed or as directed.
• Performs other duties as assigned.

Starting at $72,553 Per Year (GS 11)

MAJOR DUTIES: This is NOT an all-inclusive list.

• Initiates and implements policies and procedures required to manage sensitive compartmented information (SCI) programs and to protect SCI resources.
• Acts as resident expert on all SCI security matters.
• Functions as the technical authority in all other areas of classified security and classification guidance.
• Establishes policies and procedures for accomplishment of SCI protection and security.
• Researches, interprets, analyzes and applies Presidential Executive Orders, Director Central Intelligence Directives (DCIDs), Defense Intelligence Agency Manuals, DoD Manuals, Army / Air Force Manuals, Army Regulations / Air Force Instructions, and local Operating Instructions.
• Serves as the SCI Control Officer responsible for establishing, managing, and controlling all collateral and SCI classified information and material within the Sensitive Compartmented Information Facilities (SCIFs) affecting the Unit's mission.
• Ensures SCIFs comply with all applicable construction and physical requirements, standards, and regulations as delineated by higher headquarters.
• Works directly for the intelligence unit commander/Senior Intelligence Officer (SIO), reporting on the administration of the Special Security Office and SCI-associated security programs.
• Serves as the principal advisor to the intelligence unit commander/SIO on SCI, physical, computer, information, personnel, and administrative security.
• Manages and directs the activities and personnel of the unit Special Security Office.
• Plans and supervises work accomplished by assigned subordinates.
• Sets and adjusts short-term priorities and prepares schedules based on organization priorities and missions
• Appoints Local SCI courier officials that have a requirement to courier SCI on base and coordinates with the Defense Courier Service (DCS).
• Administers the SCI security clearance program for all assigned personnel, ensuring all required clearances are up-to-date and completed.
• Terminates or transfers SCI clearances for out-processing personnel.
• Provides oversight of unit and SSO security self-inspections and presents detailed and comprehensive reports with corrective action taken to the unit intelligence commander/SIO.
• Follows-up to ensure complete and quality resolution of discrepancies.
• Represents the intelligence unit to a variety of installation and functional areas, including national-level organizations.
• Interfaces directly with DoD, Defense Intelligence Agency, National Security Agency, Defense Intelligence Agency, US Army, US Air Force, Air Intelligence Agency, major commands, combatant commands, and other national-level agencies to evaluate, guide, and adjust unit programs to meet changing security needs and requirements as personally assessed or as directed.
• Performs other duties as assigned.

Starting at $72,553 Per Year (GS 11)

• Data Privacy Professional, with strong hands-on experience in EU & UK GDPR, POPIA, CCPA and relevant regulations.
• Manage and improve data privacy policies, standards, guidelines, and procedures to ensure the ongoing improvement and maintenance of privacy in line with applicable data privacy and protection standards & regulations such as GDPR
• Develop, supervise, and improve all data privacy measures and controls that are in place within the company
• Establishing appropriate levels of privacy controls, performance monitoring, and audits of the controls
• Planning and conducting data privacy related internal audits to assess compliance with the data privacy and protection framework.
• Work with an external auditing agency to plan, facilitate and manage external data privacy audits
• Train relevant stakeholders on data privacy and protection best practices
• Maintain an up-to-date record of all personal data processing activities
• Support client-driven privacy audits and due diligence
• Conduct third party risk management in the context of data privacy.
• Work with the development and support team to support CCPA, GDPR and POPIA compliance-related activities for our web platforms
• Hands-on experience with privacy regulations and standards like EU & UK GDPR, PECR, CCPA, ISO 27701
• Hands-on experience in managing and driving data privacy compliance mainly GDPR, POPIA and CCPA
• Hands-on experience with privacy regulations and standards like EU & UK GDPR, PECR, CCPA, ISO 27701
• Hands-on experience in managing and driving data privacy compliance mainly GDPR, PECR and CCPA

Our client is a well-established MNC, market leader in the IT industry. Due to their current expansion plan, they are looking for an Information Security Engineer to join their team, in hopes of developing the current high performing team. They are located in the West.

Responsibilities:

• Handle post-sales activities of related products and solutions.
• Engage in the implementation of large-scale projects.
• Offer on-site services, including deployment, testing and preparation of documentation.
• Provide technical assistance to maintain high levels of customer satisfaction.
• Troubleshoot customer inquiries by leveraging existing knowledgebase resources and resolving known issues.
• Be available for standby support to manage 24/7 maintenance calls.
• All other adhoc duties as assigned.

Requirements:

• Minimum diploma in IT / Cybersecurity or other related field of studies.
• Minimum 2 years’ IT support experience.
• Certified CCNA or CCSA is a bonus.

Interested candidates who wish to apply for the advertised position, please click APPLY NOW or email an updated copy of your resume/cv.

We regret that only shortlisted candidate will be notified.

Email: jobs@recruitpedia.sg

Recruitpedia Pte. Ltd.

EA License No. 19C9682

EA Reg. No. R23115553 (Lai Hor Yan)

Our client is a well-established MNC, market leader in the IT industry. Due to their current expansion plan, they are looking for an Information Security Engineer to join their team, in hopes of developing the current high performing team. They are located in the West.

Responsibilities:

• Handle post-sales activities of related products and solutions.
• Engage in the implementation of large-scale projects.
• Offer on-site services, including deployment, testing and preparation of documentation.
• Provide technical assistance to maintain high levels of customer satisfaction.
• Troubleshoot customer inquiries by leveraging existing knowledgebase resources and resolving known issues.
• Be available for standby support to manage 24/7 maintenance calls.
• All other adhoc duties as assigned.

Requirements:

• Minimum diploma in IT / Cybersecurity or other related field of studies.
• Minimum 2 years’ IT support experience.
• Certified CCNA or CCSA is a bonus.

Interested candidates who wish to apply for the advertised position, please click APPLY NOW or email an updated copy of your resume/cv.

We regret that only shortlisted candidate will be notified.

Email: jobs@recruitpedia.sg

Recruitpedia Pte. Ltd.

EA License No. 19C9682

EA Reg. No. R23115553 (Lai Hor Yan)

This role is part of our Information Security & Business Continuity team, responsible for:
• Ensuring the protection of the information in our organisation throughout the information lifecycle - that ensures the confidentiality, integrity, purpose, and availability of information, so that the organisation’s information is safeguarded from unauthorized access and misuse.
• Ensuring the availability of minimum services at a sufficient level for the business to sustain in the event of disasters.
• Horizon scanning across industry, identifying emerging trends and their potential impact and opportunity for the organisation.
The team has operational responsibility for security tooling and data (examples, but not limited to – anti-virus and intrusion prevention, security assurance platforms, security testing and monitoring platforms, etc) and for our managed services (security operations centre).
You will put people at the heart of everything you do – with a relentless focus on user experience and ensuring all our user needs are met across sites at Moorfields Eye Hospital NHS Foundation Trust.
With the ever-increasing need and interest in the use of digital technology in healthcare, you will be part of a team of Digital, Data and Technology experts that delivers service improvements and keeps at the forefront of new technology.

At this role level, you will:
• Responsible practitioner for multiple information security and business continuity services that are highly complex and high risk, ensuring performance and quality measures are aligned with business outcomes, and met.
• Define strategies and be central to assuring multiple services – improving the security and resilience of our organisational infrastructure.
• Regularly collaborate and find agreement with senior stakeholders, providing direction and challenge
• Be proactive in identifying problems and translating these into non-technical descriptions that can be widely understood.
In your role you will partner with other technology and data teams in the organisation. It is expected alongside specialist information security and business continuity skills and experience, you will have generalist or specialist experience in multiple domains:
• Cloud operations
• Data management
• Domain directory services
• Data storage and management
• Datacentre operations
• Device management
• Network security and operations
• Server architecture

At Moorfields, we provide more than just an excellent career and great colleagues to work with. We also offer:
• Salary including High-Cost Area Supplement
• Opportunity to join the NHS Pension Scheme
• Free 24/7 independent counselling service
• Learning and development opportunities
• Easy and quick transport links
• A range of attractive benefits and discounts
• Access to Blue Light Card and other NHS Discount Schemes
• Free Pilates classes
• Full support and training to develop your skills
• Flexible working friendly organisation
And so much more! To see the full range of benefits we offer please see our Moorfields benefits document.

Leadership
• Provide leadership and direction to the information security and business continuity service, including wider directorate and business teams
• Mentor and coach others, helping to develop our long-term capability including identify capability gaps and solutions
• Contribute to the development of long-term strategic plans for information security and business continuity, identifying risks and issues and developing mitigation strategies – with clear outcome measures.
Communicating between the technical and non-technical
• Identify the needs of business and technical stakeholders.
• Effectively manage stakeholder expectations.
• Demonstrate excellent communication skills and can manage difficult conversations or negotiations, including highly complex, sensitive and/or contentious information.
• Represent information security and business continuity on various internal and external groups.
Data protection and freedom of information
• Support information gathering and creating supporting narrative / recommendations for complex data protection and freedom of information requests.
• Conduct information system searches and investigations that are highly complex / sensitive in nature, to meet data protection or freedom of information needs.
• Provide advice and expert knowledge to projects / programmes / operational services to ensure that information systems are designed to meet data protection requirements.
Financial management
• Understand how to balance cost versus value.
• Consider the impact of user needs.
• Contribute and develop economic investment cases for information security – including financial models for implementation, and running of services
Governance and assurance
• Evolve and define governance.
• Take responsibility for working with and supporting other staff in wider governance.
• Assure services across sets of services.
• Use tools such as standards, guardrails, and principles to effectively govern delivery.
Information Security and Business Continuity
• Demonstrate in-depth knowledge of information security and business continuity, including analysing + testing Trust-wide capabilities and identifying improvement areas.
• Ensure that our security posture is maintained, monitored/measured and be responsible for leading interventions where standards are not met (example: security patching).
• Develop, maintain, and improve our data and technology Business Continuity & Disaster Recovery Plans, enabling us to respond to and recover from business continuity events – ensuring we can provide a safe level of service to the public during the event, and ensuring we can manage the recovery process and incorporating learning.
• Lead vulnerability audits, security & penetration tests, forensic audits, or related investigations – ensuring all findings are evaluated, and where appropriate, fed into continuous service improvement activities to continuously improve our security posture and resilience.
• Responsible for ensuring standards around information security and business continuity are embedded into service design.
• Provide subject matter expertise in major incidents, cyber security incident and/or events caused by or affecting information security.
• Act as the Problem Owner for highly complex, or sensitive information security matters (from identification through to resolution).
• Undertake Data Protection Impact Assessment (DPIA) and Information Security Assessment (ISA) activities, including supply chain / 3rd party assessments, aligned with projects / operational services.
• Maintain and improve the Information Security Assessment lifecycle, and Information Risk Management documentation for IT systems and data.
• Ensure that access to Trust systems is appropriately managed, regularly audited, and lead investigations as required.
• Provide expert advice on information transfer agreements with partner organisations in support of the Information Governance function.
• Partner with the Organisational Development and Information Governance teams and support the delivery of information security awareness and training.
Making and informing risk-based decisions
• Make decisions characterised by managed levels of risk and complexity and recommend decisions as risk and complexity increase.
• Resolve disputes between wider peers and indirect stakeholders, considering all views and opinions.
Policies, procedures, and processes
• Develop, maintain, and improve all directorate information security and business continuity policies & procedures, considering regional and national policies and practices, ensuring that both manual and electronic information across the Trust is included in-scope. Including, but not limited to – DSPT, NIS, ISO / IEC series standards, cyber essentials, etc.
Risk management
• Conduct information security risk assessments and control selection activities.
• Responsible for the management of information security and business continuity risks (for technology and data), including identifying new risks and ensure we are actively managing risk controls (for your portfolio that you are leading on).
Service focus, monitoring, and reporting
• See the bigger picture and investigate how to get the best out of the underlying services to support the organisations’ strategic objectives and business priorities.
• Take complex reporting data from multiple sources, compare, and interpret against service baseline and industry standards and provide a supporting narrative.
• Responsible for service reporting for information security and business continuity, in-line with Trust-agreed reporting measures (example: security dashboard, security operations centre performance, etc).
• Ensure we comply with external reporting for information security and business continuity (example: NHS Cyber Alerts).
Strategy
• Apply strategy, using and challenging patterns, standards, policies, roadmaps, and vision statements. You can provide guidance.
• Evaluate current information security and business continuity strategies to ensure business requirements are being met and exceeded where possible
• Responsible for managing and updating underpinning / enabling information security strategies that support the business objectives
• Ensure alignment of operating procedures and policies in-line with national, sector (ICS) and industry best practice – where it makes sense to do so.
Understanding the whole context
• Understand trends and practices outside your team and how these will impact your work.
• See how your work fits into the broader strategy and historical context.
• Consider the patterns and interactions on a larger scale.
User focus
• Explain the difference between user needs and the desires of the user.
• Champion user research to focus on all users.
• Prioritise and define approaches to understand the user story, guiding others in doing so.
• Offer recommendations on the best tools and methods to use.
Community of practice
• Develop and maintain a network of professionals to enable continuous learning and a community which can share, learn, and keep up to date on the information security and business continuity landscape, within the wider Digital, Data and Technology teams.
Other Duties:
• Deputise for the Head of Information Security & Business Continuity as required.
• Occasional work may be required outside of core business hours to support major projects / programmes.
• All other reasonable requests


This advert closes on Wednesday 13 Nov 2024

Our client is a well-established MNC, market leader in the IT industry. Due to their current expansion plan, they are looking for an Information Security Engineer to join their team, in hopes of developing the current high performing team. They are located in the West.

Responsibilities:

• Handle post-sales activities of related products and solutions.
• Engage in the implementation of large-scale projects.
• Offer on-site services, including deployment, testing and preparation of documentation.
• Provide technical assistance to maintain high levels of customer satisfaction.
• Troubleshoot customer inquiries by leveraging existing knowledgebase resources and resolving known issues.
• Be available for standby support to manage 24/7 maintenance calls.
• All other adhoc duties as assigned.

Requirements:

• Minimum diploma in IT / Cybersecurity or other related field of studies.
• Minimum 2 years’ IT support experience.
• Certified CCNA or CCSA is a bonus.

Interested candidates who wish to apply for the advertised position, please click APPLY NOW or email an updated copy of your resume/cv.

We regret that only shortlisted candidate will be notified.

Email: jobs@recruitpedia.sg

Recruitpedia Pte. Ltd.

EA License No. 19C9682

EA Reg. No. R23115553 (Lai Hor Yan)

ABOUT THE NATIONAL INSTITUTE OF EDUCATION (NIE)

The National Institute of Education (NIE), Singapore, is Singapore’s national teacher education institute and we are proud to be an integral part of the nation’s education service. We play a key role in the preparation of teachers and in the provision of teacher professional and school leadership development programmes. We are committed to our vision of being An Institute of Distinction: Leading the Future of Education and our mission to Inspire Learning, Transform Teaching and Advance Research.

NIE invites suitable candidates to join the Division of Academic Computing & Information Services (ACIS) as a Security Analyst for Governance, Risk, and Compliance (GRC). This is a 3-year contract position.

Key Responsibilities:

Governance

• Coordinate with internal and external audit teams and assist in audit planning.
• Help deliver security awareness programs for staff and manage security governance efforts.
• Stay updated on IT trends and recommend best practices to align with governance policies.
• Support cybersecurity projects to ensure alignment with security objectives.

Risk Management

• Assist in identifying and assessing IT risks and managing vulnerabilities and threats.
• Support risk management in cybersecurity projects by focusing on threats and vulnerabilities.
• Track and monitor audit remediation actions related to risk management.
• Measure the effectiveness of security awareness programs to minimize risks from human error.
  

Compliance

• Ensure compliance with internal standards (ISO 27001, ISO 22301) and external regulations.
• Facilitate responses to internal and external IT audits.
• Participate in audit engagements and report on audit issues and remediation.
• Provide ongoing compliance reporting to ensure timely remediation of audit findings.

Requirements:

Educational Qualification(s)

• A University Degree in Information Technology, Cybersecurity, Risk Management, or Compliance, or an equivalent qualification.
• Desirable Certifications: CISSP, CISM, CISA, CRISC, or other relevant certifications.

Relevant Experience

• 3-5 years of experience in Information Security, IT Risk Management, or Compliance, preferably in a higher education or similar environment.
• Experience with IT security audits and compliance reviews in regulated industries.
• Experience with vendor security assessments and managing third-party security risks.
• Experience in security awareness training and working in cross-functional teams.

Knowledge Required

• Security Frameworks: ISO 27001, CTM, NIST, CIS controls, and their application in operational environments.
• Regulatory Standards: Understanding of the Cybersecurity Bill, PDPA, and related security laws.
• Risk Management: Knowledge of risk assessments, mitigation strategies, and identifying threats to information systems.
• Audit Processes: Understanding security audit processes, compliance, and remediation.
• IT System: Good knowledge of IT infrastructure, application management, and cybersecurity practices.
• GRC Tools: Experience with Governance, Risk, and Compliance platforms and software is advantageous.

Skills and Competencies

• Analytical Skills: Ability to analyze security risks and make data-driven decisions.
• Communication Skills: Ability to convey technical security concepts to non-technical audiences and document findings.
• Problem-Solving: Strong problem-solving capabilities, particularly during security incidents.
• Attention to Detail: High focus on detail in audits and risk assessments.
• Project Management: Ability to manage multiple projects, prioritize tasks, and meet deadlines.
• Team Collaboration: Proven ability to work with cross-functional teams (IT, legal, compliance, vendors).

Other Personal Attributes

• Integrity and Confidentiality: High ethical standards and the ability to handle sensitive information.
• Proactivity: Ability to act independently and proactively address security challenges.
• Adaptability: Capable of adjusting to evolving security threats and changes in regulations.
• Resilience under Pressure: Ability to make sound decisions under pressure, particularly during audits or security incidents.

Other Information

NIE staff can take chartered buses at their own expense from or near their home to the NIE campus. This is subject to the availability of bus routes and seats.

Req ID: R00018942