Specific duties:
Cyber Security Leadership
- Develop and deliver the firm’s cyber security strategy in line with the firm’s goals and risk appetite.
- Lead and continuously improve the firm’s cyber security capability, roadmap and maturity.
- Act as the firm’s senior cyber security subject matter expert.
- Provide security leadership across technology including data, cloud, infrastructure and business projects and initiatives undertaken.
- Promote a positive cyber security culture across the firm.
- Define clear security objectives, success measures and reporting that demonstrate progress against the firm’s cyber risk profile and strategic priorities.
Security Operations
- Own and manage the firm’s security operations capability.
- Manage and continuously improve the firm’s outsourced Security Operations Centre (SOC).
- Oversee security monitoring, threat detection and incident management processes.
- Lead the investigation and response to cyber security incidents.
- Oversee vulnerability management, remediation planning and security improvement activities.
- Coordinate annual penetration testing exercises and remediation programmes.
Security Assurance & Architecture
- Provide security oversight and assurance across infrastructure, cloud platforms, SaaS solutions and business applications.
- Set and maintain security architecture principles and standards that guide technology change across infrastructure, cloud platforms, SaaS solutions, data and business applications.
- Ensure security and privacy-by-design principles are incorporated into technology change initiatives.
- Provide security approval, challenge and assurance at appropriate project governance stages, including early design review, procurement, implementation and go-live readiness.
- Escalate material security risks, exceptions and risk acceptance decisions where proposed solutions do not meet agreed standards or fall outside the firm’s risk appetite.
- Work closely with the Head of IT Operations to align operational and security priorities.
Governance, Risk & Compliance
- Maintain responsibility for ISO27001 certification and continuous improvement activities.
- Maintain Cyber Essentials Plus certification.
- Manage security policies, standards and procedures.
- Conduct ongoing security risk assessments and track remediation activities.
- Provide regular reporting to senior leadership.
- Support the CLO and General Counsel on governance, regulatory and compliance matters as required.
- Provide clear, risk-based reporting to the CIO, and senior leadership, including key risks, control effectiveness, remediation progress and areas requiring decision or escalation.
Business Continuity & Resilience
- Support the Chief Legal Officer in maintaining and developing the firm’s ISO22301 Business Continuity Management System.
- Coordinate testing and exercising of business continuity and disaster recovery arrangements.
- Support the firm’s operational resilience objectives.
Supplier & Client Security
- Own the firm’s third-party security assurance programme.
- Assess supplier security controls and support technology procurement activities.
- Support client security audits, due diligence requests and tender responses.
- Provide security input into significant client opportunities and strategic initiatives.
Data Security & AI
- Work closely with the Head of Data, Director of Innovation and CLO/DPO to ensure appropriate security controls are applied to the firm’s data, reporting, analytics and AI initiatives.
- Provide security and risk advice relating to AI solutions, data protection and emerging technologies.
- Support the secure adoption of data and AI services across the firm.
Leadership & Team Management
- Lead, develop and mentor members of the Information Security team.
- Manage external security suppliers and partners.
- Establish a culture of accountability, continuous improvement and professional development.
- Support the ongoing development of cyber security awareness and capability across Technology Services.