Head of Information Security

Kingsley Napley LLP

9.30 am to 5.30 pm, flexible applications considered

Working week:

Monday – Friday

Department:

IT

Purpose of job:

The post holder will be responsible for the Firm’s Information Security function and related functions, reporting to the CIO and subject to oversight from the firm’s General Council and DPO.

The post holder will manage the Firm’s ISO, Cyber Essentials, GDPR compliance programmes, and an ongoing information security risk assessment program, as well as initiating and managing information governance initiatives. In addition, the post holder will work with the firm’s Technology and Innovation teams by providing advice and consultancy regarding the information security implications of any software and hardware implementations, changes, and upgrades.

The post holder will advise on the drafting and embedding of information security policies, monitor compliance, assist with the assessment of cyber security risks, mitigation initiatives, and assist with the Firm’s Cyber Security and Information Security Incident response plans. The post holder will manage the information security team and key security suppliers, including the firm’s Security Operations Centre.

Specific duties:

• In conjunction with the CIO and the information security committee, develop and continuously improve the firm’s information security strategy.
• Manage and maintain certification as well as continuously improve the firm’s Integrated Management System (ISO 27001, ISO 22301, ISO 9001).
• Maintain certification and continuously improve the firm’s Cyber Essential Plus programme.
• Ensure ongoing compliance with the UK GDPR Regulation in conjunction with the firm’s Data Protection Officers.
• Line management responsibilities for the firm’s security analyst; providing regular feedback and conducting regular performance check-ins.
• Provide leadership, encouragement, and development opportunities for the firm’s security analyst and maintain a culture of high performance/high support and operational excellence.
• Develop and manage the firm business continuity and disaster recovery programmes in line with ISO 22301.
• Manage and deliver a successful internal IMS audit programme and deliver successful external audits.
• Manage and continuously improve the firm’s outsourced Security Operations Centre.
• Chair Information Security committee meetings and provide senior management with updates and advice as required.
• Implement security awareness training initiatives and communication plans to promote security awareness in the Firm.
• Work with the Firm’s DPO in responding to Subject Access Requests, updating and implementing the Firm’s Information Security Incident response plans, and dealing with breach notifications.
• In conjunction with the Firm’s IT team and information security committee, continually develop and improve upon the firm’s fraud prevention capabilities.
• Advise and assist the project management and Innovation teams on information security related aspects of projects.
• Advise and assist the IT and Innovation teams on the Information Security implications of all software and hardware upgrades and changes.
• Advise and assist the firm and its key stakeholders on the implementation of new processes.
• Advise and assist with the firm’s annual cyber insurance review.

To apply for this role, please complete the online application form.
For further information about this position, please contact, in confidence, Natalie Slater (Head of Talent Attraction and Recruitment) at .