This job has expired, please see additional jobs below
IT Security Manager
Entertainment & Media Industry Company
Rotherham, , United Kingdom
Job Details - this job has expired, please see similar jobs below
Description
At Company, we’re committed to a world that’s always learning and to our talented team who makes it all possible. From bringing lectures vividly to life to turning textbooks into laptop lessons, we are always re-examining the way people learn best, whether it’s one child in our own backyard or an education community across the globe. We are bold thinkers and standout innovators who motivate each other to explore new frontiers in an environment that supports and inspires us to always be better. By pushing the boundaries of technology — and each other to surpass these boundaries — we create seeds of learning that become the catalyst for the world’s innovations, personal and global, large and small.
Through the NCT programme, Company delivers assessment services for National Curriculum Tests at Key Stage 2, tests used to help measure progress at the end of primary school across England. The NCT programme manages the delivery of these services under contract with the Standards and Testing Agency. The services encompass the registration of pupils for the tests, the design and production of marker training materials, training of 4.5k markers, the marking of approximately 4 million completed tests and the delivery of test results to 16.5k schools across the UK, securely as well as to time and quality.
An extensive programme of ‘back office’ activities support the delivery, ranging from IT infrastructure and software services, print, logistics services, marker recruitment services, training, through to programme management, risk management, Helpdesk services and security management.
Company has to ensure its delivery of the NCT programme is compliant with both contractual and industry-best practice security requirements.
Company’s Chief Information Security Office (CISO), part of the Company Technology services, shapes security provision across Company, providing and leading on expertise in security architecture & engineering, forensic investigation, governance risk & compliance (GRC) as well as defining and maintaining corporate level policies and standards. Protection of the data involved in the services is of paramount importance to Company, requiring pro-active management of security practices and controls throughout the provision of NCT services.
Key Responsibilities:
• Support the NCT Head of Security with all IT Security aspects of information governance and security management relating to Company and its NCT sub-contractors.
• Be a champion of Global Security Policies and Standards, including the NCT security policy across the Company IT Services, ensuring compliance with the relevant version of the Cabinet Office Security Policy Framework and the principles of ISO 27001.
• Monitor and report on compliance with the security policies in the delivery of the Service, including within the NCT programme and across the Company organisation.
• Provide support to the Company IT organisation in relation to security requirements as defined in the NCT contract, meeting internal service levels including timely resolution of customer queries with a high standard of customer communication and support.
• Lead, conduct and document investigations relating to IT security and IT DR BCP incidents ensuring compliance with ITIL, ISO 27001 and ISO 22301 as appropriate to the incident.
• Support the NCT Head of Security with the reporting of security incidents to stakeholders.
• Be a champion of the IT DR solution with regard to NCT Business Continuity Plan, leading on the production of comprehensive NCT documentation through the execution of the Company defined business continuity process for DR, including running business impact analysis across the Technology organisation programme, supporting the NCT programme in instances of business disruption and production of reports on status of business Technology recovery.
• Preparation of management information and report production relating to the IT security status of the NCT programme.
• Undertake key Company tasks within the Government security accreditation process (known as DSAM) that NCT is subject to, including:
• Planning and commissioning of ITHC/pentests, and management of outputs from the tests in collaboration with the IT Project Manager as to the remediation of the findings.
• Planning and coordinating appropriate levels of internal security testing across the NCT environments, including web application and infrastructure vulnerability assessments, ensuring that open vulnerabilities are remediated in accordance with internal policies and contractual obligations.
• Dissemination across Company teams of requests for information regarding the NCT system, management of those requests through to receipt of information, and onward clear communication of the information into the accreditation process.
• Representation of Company with a variety of interfaces within the accreditation process, including STA, DfE, and specialist expertise providers (eg a CESG, CCP).
• Identification, escalation, mitigation and review of risks, issues and opportunities for continual improvement relating to these IT security activities and related programme activities.
• Monitor and ensure the implementation of security processes of subcontractors involved in the NCT programme, ensuring their service delivery complies with HMG’s SPF.
Qualifications
Essential
• Experience of implementation of security management within the bounds of compliance with HMG’s Security Policy Framework, ISO 27001, RMADS, and ISO 22301.
• Experience of investigation techniques and report writing.
• Experience of risk management methods and logging of risks.
• Experience of process mapping and delivery of effective and understandable process maps and associated procedures.
• Ability to interact with senior management stakeholders, with excellent verbal and written communication skills, build strong relationships at all levels and across all business units and organisations, and understand business imperatives.
• Adherence to high quality written communications, required by the client and expected across Company and the NCT programme.
• Understanding of extensive and wide-ranging security requirements defined in in-depth contractual documents.
• Distillation of the security requirements into practical, proportionate and understandable instructions and guidance across the programme.
• Working within a regulated framework and PRINCE2 contractual delivery requirements.
• Security certification such as CISMP (Certified in Information Security Management Principles), Certified Information Systems Security Professional (CISSP), Certified Information Systems Manager (CISM), ISSMP (Information Systems Security Management Professional).
• ISO 27001 Lead Auditor and/or Lead Implementor
• Prince 2 Foundation level or above.
Desirable
• A bachelor degree in information systems or equivalent work experience.
• CCP (CESG) Certified
• Familiarity with applicable legal and regulatory requirements, including, but not limited to, the U.S. Sarbanes-Oxley Act, the U.S. Health Insurance Portability and Accountability Act (HIPAA), the European General Data Privacy Regulation (GDPR), and PCI/DSS.
• Knowledge of a broad range of security technologies, including NextGen Firewalls, DLP, NAC, IDS/ IPS, IdAM, PKI, SIEM, Anti-malware, vulnerability management.
• Hands-on experience scoping and managing vulnerability assessment and penetration test.
• Working knowledge of Industry Standard Product and Program Development Life Cycle, including Secure SDLC and the principles of Agile software development.