Information Security Officer

Sure Staffing

Information Security Officer

Contract Length: 6 months

Daily Rate: (Apply online only) daily umbrella, inside IR35

Location: Fully remote – must be based in the UK

Please note our client is unable to offer sponsorship, to apply you must have current, valid proof of Right to Work in UK

Our Client is recruiting for an Information Security Officer to play a key role in enabling the Information Security function to deliver timely security advisory and assurance services, supporting their information security program objectives.

This senior role involves communicating information security strategy and requirements to internal and external stakeholders.

Main Responsibilities:

Information Security Consultancy:

• Respond to internal and external inquiries about the organisation’s information security controls and governance framework
• Provide high-quality consultancy services aligned with business risk appetite
• Lead responses to information security-related incidents, ensuring timely investigation, effective communication, and appropriate actions
• Offer insights into the threat landscape for evidence-based advice on threat mitigation techniques
• Collaborate with third-party suppliers for assessing and auditing their information security posture
• Respond to client security questionnaires, highlighting compliance gaps, proposing compensating measures
• Deliver information security compliance and assurance assessments for IT and business projects
• Maintain in-depth knowledge of relevant information security standards and frameworks

Information Security Advisory in IT & Business Projects:

• Undertake the information security advisor role for IT and business projects, including risk assessments and documentation
• Collaborate with Data Privacy and Business Continuity functions to provide relevant information
• Provide assurance actions and documentation for information security accreditation

3rd Party Security Advisory and Assessments:

• Independently assess the security control and governance framework of prospective and existing third-party technology solutions and cloud service providers
• Conduct third-party information security risk assessments, including risk mitigation controls
• Assess and define contractual security requirements and conduct regular assessments of third-party compliance

Security Awareness Duties:

• Actively participate in the organisation’s Cyber Awareness program, defining and delivering content through various communication channels
• Educate staff and third parties on their role in protecting information assets

Security Incident Response Duties:

• Support the organisation’s information security incident management processes
• Lead or participate in assigned information security response scenarios and root cause analysis

Security Controls Assurance Assessment Duties:

• Conduct administrative, physical, and technical controls assessments to ensure security controls are implemented and operational

ISMS Continuous Improvement Activities:

• Participate in activities to maintain and continuously improve the organisation’s Information Security Management System (ISMS)

Risk and Control:

• Ensure all activities comply with regulatory requirements and internal policies

Essential Skills and Experience:

• Thorough understanding and demonstrated experience implementing ISO 27001/27002 controls
• Industry certifications such as CISSP, CISM, CRISC, AWS, AZURE, ISO27001 Lead Auditor, and CISA
• Excellent knowledge of ISO27005 Risk Management standard or NIST RMF
• Understanding of global Data Protection and Privacy regulations
• Ability to work effectively across all business support functions
• Excellent analytical, written, and communication skills
• Proficiency in MS Office applications

Desired Skills and Experience:

• Previous experience in a professional services organisation or the legal sector
• Familiarity with ITIL, Prince 2, Agile methodologies
• Previous experience in implementing the NIST Risk Management Framework