Information Security Officer

**Information Security Officer** Are you looking to join a company you can truly grow with that provides industry training, support for obtaining certifications, and clear career progression paths and opportunities? One of the clients we work most closely with, a legal firm in Leeds city centre that specialises in the financial and insurance sectors, is looking for an Information Security Officer that will take ownership of all day-to-day aspects of information securityand information assurance. They have a friendly, supportive and trust-based environment, are truly passionate about retaining and rewarding talent, and provide training and ample opportunities for career progression, no matter what your ambitions are. They're all about sharing knowledgeand experiences, and they always recognise everyone's input and contributions. If you are passionate about your personal development, they will help you set up a plan to support this from the outset. They are also great at setting up frequent reviews to ensure you are staying on track and feeling that you are both adding value to thebusiness and getting what you need from your job. **What we're offering**: - A salary of up to 45k - A mostly remote role - usually up to twice a month in their Leeds city centre office - Access to industry-leading training and certifications - Clear expectations and opportunities for development and career progression **Skillset required**: - Demonstrable experience in a similar Information Security / Risk Management role - Good understanding and demonstrable experience of enterprise risk management. - Demonstrable experience of contributing to the delivery and ongoing maintenance of an ISO27001 certification programme and NIST Cybersecurity Framework compliance - Certified in Information Security or Risk Management or working towards attaining such a qualification - Experience designing and delivering employee security awareness & compliance training - Excellent communication, relationship building and stakeholder management, with the ability to influence and negotiate with employees, board members, contractors, and suppliers at all levels, in order to ensure adherence to the information security strategyand that any issues and incidents are being reported **Key responsibilities**: - Establish and maintain an information security programme to achieve the firm's overarching Information Security strategy, providing regular progress reports against the programme - Work with the Compliance and IT teams to develop, publish, and maintain a people-focused "best practice" Information Security framework and associated company policies. This should include the definition of roles and responsibilities with regards to informationownership, classification, accountability, and protection of information assets - Ensure all information security incidents are reported in keeping with the firm's procedures, and logged in the IS incident register, with provision of regular reporting around these and appropriate remediation plans overseen - Define all operational security standards, plans, protocols, and processes in collaboration with relevant stakeholders. - Work with general counsel and business leaders to ensure that the firm's information security requirements are included in all relevant 3d party contracts - Work with 3rd party suppliers to ensure they meet the firm's minimum standards for information security, through use of information assurance questionnaires, audits, and active involvement in supplier management - Oversee and manage the responses to client information assurance questionnaires and coordinating client audit requests in collaboration with the Risk and Compliance team - In coordination with the Learning and Development team, develop and maintain a training and awareness programme for the firm along with metrics to measure and audit its effectiveness - Work with staff at all levels to embed information security principles within practice areas and day-to-day working - Work effectively with business leaders to facilitate information security risk assessments and risk management processes, ensuring all associated risks are documented with appropriate treatment plans in place - Active involvement in the firm's external audit analysis group to facilitate and assist remediation activities against known weaknesses - Assist the IT, Risk and Compliance teams in maintaining the firm's information security and quality accreditations, such as Cyber Essentials Plus and Lexcel - Ensure the firm's policies and procedures relating to information security are maintained, effective and include regular reviews and updates of departmental processes and procedures, ensuring all relevant documentation and registers are maintained at alltimes - Support the firm's internal audit function in examining, evaluating, and making recommendations regarding the adequacy and effectiveness of the firm's policies, controls and procedures relating to Information Security - Collaborate with the firm's Technical Design Authority (TDA) and IT Change Advisory Board (CAB) to ensure all new solution designs and system changes adhere to secure by design principles - Liaise with the relevant IT teams for vulnerability management and penetrating testing frameworks - Coordinate incident response plans and procedures to ensure that business-critical services are recovered in the event of a security event, providing direction, support and in-house consulting across relevant business areas