Information Security Manager
Posted Updated 23
views
Summary
Information Security Manager at Ward Hadaway LLP, a UK top-100 law firm. The role leads a small team owning ISO27001 certification, the Integrated Management System, security risk assessments, incident response, data protection compliance, and audits, working hybrid from the Newcastle or Leeds office.
We are looking for an Information Security Manager to join our Risk and Compliance team to be located from either our Newcastle or Leeds office.
The successful candidate will be expected to work with the wider firm to deliver a commercial, pragmatic, effective and risk-based approach to activities that provide appropriate access to, and protect the confidentiality, availability and integrity of client, employee, and corporate information. You will also work with the firm's Technology and Change Team on an on-going basis to provide advice and consultancy regarding the information security implications of any software and hardware implementations, changes and upgrades.
There will also be some involvement in advising and drafting of information security policies, monitoring compliance, providing assistance in relation to the assessment of cyber security risks, mitigation initiatives and assisting with the firm’s incident response plans.
What will I be doing?
You'll support the Director of Risk & Compliance in leading the firm's risk, compliance, information security and data protection activities, whilst managing a small team and driving a culture of continual improvement across the business. You'll own all aspects of the firm’s ISO27001 certification in addition to owning the ongoing development and operation of the firm's Integrated Management System (IMS) ensuring that information security, risk management, compliance and assurance processes operate effectively within a coordinated governance framework. You will oversee an ongoing information security risk assessment programme, alongside developing and implementing and security and governance initiatives.
Working collaboratively with the firm's Technology and Change, Risk and Compliance, General Counsel, and wider teams and key stakeholders across the business, the role will provide practical, commercial and risk-based information security advice to support the firm's objectives and protect client, employee and corporate information.
The role will play a key part in supporting the firm's risk, compliance and information security objectives, including, but not limited to:
Leading, developing and mentoring a small high-performing team.
Information security governance and assurance.
Information security incidents and data breaches.
Supporting the development and implementation of the firm's risk management framework, controls and governance arrangements.
Conducting supplier and third-party due diligence, including security, data protection and risk assessments.
Managing the firm's ISO 27001 programme with the support of an Information Security Analyst.
Overseeing information security, information governance and data protection programmes, ensuring compliance with legal, regulatory and business requirements.
Planning, coordinating and supporting internal and external audits, assurance activities and the effective management of corrective actions.
Supporting cyber security from an information security perspective.
Delivering training, guidance and awareness initiatives to strengthen risk, compliance and information security culture across the firm.
Supporting business continuity, disaster recovery and cyber resilience activities.
Providing information security advice and guidance to support the firm's adoption and use of AI tools and technologies.
Working with our General Counsel team on personal data breaches, providing information security advice and support where required.
You'll have
Strong leadership in driving security initiatives within a firmwide context.
In-depth knowledge of data protection legislation (Data Protection Act 2018, UK and EU GDPR).
Proven experience in a similar role, preferably within a law firm or professional services environment.
Expertise in information and cyber security controls, particularly ISO27001, and comprehension of technical IT concepts.
Robust understanding of technical and organisational security controls, with a keen ability to evaluate and mitigate risks.
Industry certifications such as CISSP or CISM are highly desirable.
Exceptional communication skills, with the ability to convey technical issues clearly to diverse audiences.
Strong relationship-building skills.
Excellent problem-solving and decision-making skills.
Proven ability to work both as part of a team and individually with a flexible "can-do" attitude.
About us
We're proud to be an independent, full-service law firm providing exceptional legal expertise to businesses, the built environment, healthcare, the public and third sectors, and private individuals. With several office locations around the UK we're one of the UK's Top 100 law firms. When you join us you’ll be part of a team of over 500 passionate and talented individuals who take pride in offering an exciting and supportive environment allowing you to thrive.
We're passionate about promoting wellbeing and equality, diversity and inclusion, with dedicated committees to support ongoing efforts. We recognise that a healthy and thriving Firm filled with individuality and differences strengthens our teams, our clients and our communities.
What we can offer you
We’re committed to being a firm focused on support, development, wellbeing and inclusion and we’re always striving to improve. Our commitment to this has been recognised by our achievement of our Gold Investors in People award and by our Hive HR Employee Voice certification.
We reward our people with a whole range of benefits, some core and some flexible, designed to shape a reward package that’s right for you – now and in the future. Our core benefits include:
An enhanced pension scheme with employer matched contributions of up to 6%.
25 days' annual leave + bank holidays (increasing to 28 days with length of service). There is also the option to purchase up to 5 additional days.
Life assurance cover of 4 times basic salary, with the option to purchase additional cover.
A range of health and wellbeing benefits.
Hybrid working with a minimum requirement of 2 days per week working from one of our offices.
We also have a flexible benefits programme where you can purchase a wide range of additional benefits.
If you would like to request further information or to discuss the role, please contact quoting vacancy reference NTX1247087.
If you require any adjustments to be made to our recruitment process, please request a call back via the above email address.
Agencies - please note that we are not currently instructing agents to support with this role. Please do not send speculative CVs.
The successful candidate will be expected to work with the wider firm to deliver a commercial, pragmatic, effective and risk-based approach to activities that provide appropriate access to, and protect the confidentiality, availability and integrity of client, employee, and corporate information. You will also work with the firm's Technology and Change Team on an on-going basis to provide advice and consultancy regarding the information security implications of any software and hardware implementations, changes and upgrades.
There will also be some involvement in advising and drafting of information security policies, monitoring compliance, providing assistance in relation to the assessment of cyber security risks, mitigation initiatives and assisting with the firm’s incident response plans.
What will I be doing?
You'll support the Director of Risk & Compliance in leading the firm's risk, compliance, information security and data protection activities, whilst managing a small team and driving a culture of continual improvement across the business. You'll own all aspects of the firm’s ISO27001 certification in addition to owning the ongoing development and operation of the firm's Integrated Management System (IMS) ensuring that information security, risk management, compliance and assurance processes operate effectively within a coordinated governance framework. You will oversee an ongoing information security risk assessment programme, alongside developing and implementing and security and governance initiatives.
Working collaboratively with the firm's Technology and Change, Risk and Compliance, General Counsel, and wider teams and key stakeholders across the business, the role will provide practical, commercial and risk-based information security advice to support the firm's objectives and protect client, employee and corporate information.
The role will play a key part in supporting the firm's risk, compliance and information security objectives, including, but not limited to:
Leading, developing and mentoring a small high-performing team.
Information security governance and assurance.
Information security incidents and data breaches.
Supporting the development and implementation of the firm's risk management framework, controls and governance arrangements.
Conducting supplier and third-party due diligence, including security, data protection and risk assessments.
Managing the firm's ISO 27001 programme with the support of an Information Security Analyst.
Overseeing information security, information governance and data protection programmes, ensuring compliance with legal, regulatory and business requirements.
Planning, coordinating and supporting internal and external audits, assurance activities and the effective management of corrective actions.
Supporting cyber security from an information security perspective.
Delivering training, guidance and awareness initiatives to strengthen risk, compliance and information security culture across the firm.
Supporting business continuity, disaster recovery and cyber resilience activities.
Providing information security advice and guidance to support the firm's adoption and use of AI tools and technologies.
Working with our General Counsel team on personal data breaches, providing information security advice and support where required.
You'll have
Strong leadership in driving security initiatives within a firmwide context.
In-depth knowledge of data protection legislation (Data Protection Act 2018, UK and EU GDPR).
Proven experience in a similar role, preferably within a law firm or professional services environment.
Expertise in information and cyber security controls, particularly ISO27001, and comprehension of technical IT concepts.
Robust understanding of technical and organisational security controls, with a keen ability to evaluate and mitigate risks.
Industry certifications such as CISSP or CISM are highly desirable.
Exceptional communication skills, with the ability to convey technical issues clearly to diverse audiences.
Strong relationship-building skills.
Excellent problem-solving and decision-making skills.
Proven ability to work both as part of a team and individually with a flexible "can-do" attitude.
About us
We're proud to be an independent, full-service law firm providing exceptional legal expertise to businesses, the built environment, healthcare, the public and third sectors, and private individuals. With several office locations around the UK we're one of the UK's Top 100 law firms. When you join us you’ll be part of a team of over 500 passionate and talented individuals who take pride in offering an exciting and supportive environment allowing you to thrive.
We're passionate about promoting wellbeing and equality, diversity and inclusion, with dedicated committees to support ongoing efforts. We recognise that a healthy and thriving Firm filled with individuality and differences strengthens our teams, our clients and our communities.
What we can offer you
We’re committed to being a firm focused on support, development, wellbeing and inclusion and we’re always striving to improve. Our commitment to this has been recognised by our achievement of our Gold Investors in People award and by our Hive HR Employee Voice certification.
We reward our people with a whole range of benefits, some core and some flexible, designed to shape a reward package that’s right for you – now and in the future. Our core benefits include:
An enhanced pension scheme with employer matched contributions of up to 6%.
25 days' annual leave + bank holidays (increasing to 28 days with length of service). There is also the option to purchase up to 5 additional days.
Life assurance cover of 4 times basic salary, with the option to purchase additional cover.
A range of health and wellbeing benefits.
Hybrid working with a minimum requirement of 2 days per week working from one of our offices.
We also have a flexible benefits programme where you can purchase a wide range of additional benefits.
If you would like to request further information or to discuss the role, please contact quoting vacancy reference NTX1247087.
If you require any adjustments to be made to our recruitment process, please request a call back via the above email address.
Agencies - please note that we are not currently instructing agents to support with this role. Please do not send speculative CVs.