Information Security and Data Protection Advisor

Join us as an Information Security and Data Protection Advisor and play a vital role in safeguarding our organisation's information assets. In this pivotal position, you'll help maintain a robust security posture while ensuring compliance with data protection regulations. Working closely with our Information Security Manager and Data Protection team, you'll lead on risk assessments, policy development, incident response, and security awareness initiatives, while supporting privacy compliance frameworks and data subject rights. This is your opportunity to make a real impact in creating a safe and secure environment for both our passengers and colleagues.

In addition to the proactive work, there is also a portfolio of project work that you will have the opportunity to get involved in.

You will need to be keen to learn and get your hands dirty to support the team as we grow as an organisation and change and transform into a new entity under public ownership.

This role is hybrid with 3 days based form our office in central Birmingham.

• Support the Information Security Manager in maintaining the organisation's security framework.
• Carry out risk assessments and help develop practical mitigation plans.
• Monitor and respond to security incidents, ensuring timely investigation and reporting.
• Provide clear, expert advice on security and privacy for projects and day-to-day operations.
• Deliver engaging security awareness training and campaigns to build a strong security culture.
• Assist with creating and updating security policies and procedures.
• Manage third-party security checks and supplier assurance activities.
• Support data protection work, including impact assessments and data subject requests.
• Help maintain compliance with UK GDPR and other data protection legislation.
• Stay informed about emerging threats and regulatory changes.
• Contribute to wider safety and security initiatives across the organisation.

• Educated to degree level or equivalent experience in a relevant field such as Information Security, Computer Science, Cybersecurity, or a related discipline.
• Awareness of common security threats (e.g. phishing, malware, social engineering).
• Familiarity with data protection concepts and relevant legislation (e.g. UK GDPR).
• Understanding of maintaining information security frameworks based on best practices.
• Knowledge of Information Security Management Systems
• Experience in protection of IT systems or networks, using security tools.
• Experience working in a team environment and following structured processes.
• Willingness to learn and develop in the fields of information security and data
• Ability to manage time effectively and prioritise workload.
• Basic proficiency in Microsoft Office tools (e.g. Word, Excel, PowerPoint); familiarity with security or compliance tools is a bonus.

• Salary - £30,000 - £40,000 depending on experience
• Hybrid working - 3 days in Birmingham office
• Defined Benefit pension – one of the best in the UK
• Free travel on all our trains and 75% off all other train company travel tickets
• Retail discounts
• Career development opportunities

We are proud to operate two new railway brands for and to the Midlands, the North West and London.

In the Midlands the West Midlands Railway brand is a local railway placing Birmingham at the centre of its network. We run the majority of the local services, as well as direct trains to many of the surrounding towns and cities, including Redditch, Stratford-upon-Avon, Worcester, Hereford, Shrewsbury, Telford, and Northampton.

Our London Northwestern Railway brand serves the London to Liverpool route on the west coast, stopping at Birmingham, Milton Keynes and Northampton, with the West Midlands at its heart.

Both services are operated by West Midlands Trains Ltd, part of Transport UK.

Each business brings a wealth of knowledge and expertise to the franchise and it's our aim to give you the rail experience you deserve at the price you want to pay.