Head of Information Security

Job Purpose Leading an Information Security & Records Management team, the postholder will work closely with CityCares Senior Information Risk Owners, Caldicott Guardians and key Information Management and Cyber Security colleagues to provide a high-quality Information Security, Records Management and Data Protection Service to CityCares Directorates. The postholder will assist the Senior Management Team in providing vital support and assurance on CityCares current and proposed future developments with data protection legislation including the UK General Data Protection Regulation, Data Protection Act, Records Management Legislation and good practice, providing expert advise to all levels of the organisation. The postholder will ensure robust systems of assurance are in place for Information Security / Information Governance, Data Protection and Records Management and provide strategic leadership by advising Senior Management on the priorities and risks for Information, Cyber and Records Management in line with legislative requirements and best practice. The postholder will lead on CityCares submission of the Data Security and Protection Toolkit submission.
The postholder will also fulfil the statutory role of Data Protection Officer under current data protection legislation to ensure compliance with GDPR, in which the role will be accountable to the Director of Finance and Corporate Services / Senior Information Risk Owner. Dimensions The postholder will provide strategic leadership to a range of Information Security, Data Protection and Records Management programmes, working with Digital, Information Technology, Cyber Security and other specialists to deliver an agreed set of best practices and operational considerations for CityCare. The postholder will provide assistance to the Senior Leadership Team, Managers and Project Leads to ensure standards of confidentiality, security, integrity and availability of the organisations personal and corporate data is effectively managed, including the development of strategies, policies and standard operating procedures. The postholder will provide expert advice to Senior Management and all employees on matters relating to Information Security, Data Protection and Records Management and related legislation including the Data Protection Act, GDPR, PECR, FOIA, Access to Information, Records Management Code of Practice, Common Law Duty of Confidentiality etc.
**Key Responsibilities Data Protection Officer**: To undertake the statutory / legislative role of Data Protection Officer. To inform and advise the organisation and its employees of their obligations under the UK General Data Protection Regulation, and other national data protection legislation. To advise the organisation on all aspects of the General Data Protection Regulation in an independent and autonomous manner. To be the named contact point and to work with the Regulatory Authority (Information Commissioners Office (ICO)), seeking advice where necessary, escalating information risks and supporting in full with any ICO Lead enquiries.
To develop effective relationships and ensure the organisation is involved in local, regional and national networking opportunities. Provide specific support to the Senior Information Risk Owner, Caldicott Guardian and their deputies, and to relevant teams and individuals. Ensure Data Protection Impact Assessments are carried out and become embedded whilst identifying high risk processing where mitigating actions are insufficient to reduce the risk to an acceptable level and where proactive escalation and support from the ICO is required. Initiate investigations into complaints about breaches of the Data Protection Act/GDPR and undertake reporting/remedial action as required.
Assist with complaints in relation to data protection and release of information especially where Commissioners and National Inquiries are involved. Ensure serious information breaches are reported in line with the GDPR requirements in terms of timescales and overseeing bodies, involving and keeping updated the Information Commissioners Office as necessary. Undertake highly complex information risk analysis and management, particularly of Personal Identifiable Data (PID) and via data flows. Information Security, Records Management and Cyber Security: To provide day to day line management for the Information Security and Records Management team.
To provide strategic direction, advice and guidance on the diverse range of topics and issues that constitutes Information Security across CityCare. Responsible for ensuring the Data Security and Protection Toolkit (DSPT) returns are completed for CityCare, relevant to a Community Provider organisation. Generating assurance and supporting Managers/Service Leads to comply with the requirements of the DSPT standards, implementing remedial measures and developments identified during the management of the DSPT. To facilitate information security compliance with ISO 270