Information Security Governance Lead

DLA Piper LLP; Greater London; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Flexible working arrangements

Inclusion and diversity

Job summary

DLA Piper is seeking an Information Security Assurance Lead to own the ISO 27001:2022 framework, coordinate audits, and drive continual improvement across policy, risk and governance processes. The role involves testing security controls, reporting findings to stakeholders, and supporting risk-based decision making.

You will collaborate with the enterprise risk team to ensure regulatory and contractual obligations are met, while contributing to security awareness and client-facing assurance

Qualifications

• Experience operating or supporting an ISO 27001 Information Security Management System
• Knowledge of information security control frameworks and assurance methodologies
• Knowledge of Cyber Essentials Plus
• Ability to assess the effectiveness of security controls and identify improvement opportunities
• Experience coordinating audit, certification or assurance activities
• Ability to translate technical and governance topics into practical business outcomes
• Experience presenting security findings, recommendations and risk information to stakeholders
• Experience identifying, assessing and managing information security risks
• Understanding of information security threats, vulnerabilities and control environments
• Experience applying risk management principles, frameworks and methodologies
• Ability to evaluate the potential business impact of security risks and control gaps

Responsibilities

• Own and maintain the ISO 27001:2022 Information Security Management System
• Coordinate internal and external certification audits
• Manage the lifecycle of policies, standards and supporting documentation
• Facilitate management reviews and support continual improvement activities
• Ensure security governance processes remain aligned to business objectives and evolving risk
• Design and operate a programme of security control testing and assurance activities
• Assess the effectiveness of administrative, technical and operational controls
• Produce assurance reports and communicate outcomes to relevant stakeholders
• Monitor remediation activities and support closure of identified weaknesses
• Develop assurance dashboards, metrics and management reporting
• Support the ongoing maturity of the security governance framework
• Review the impact of regulatory, industry and client requirements on the control environment
• Contribute to internal security awareness and governance initiatives
• Support external client requests relating to security assurance and certification activities where required
• Facilitate identification, assessment and evaluation of security risks
• Provide analysis and recommendations to support risk-based decisions
• Monitor risk treatment activities and provide challenge where appropriate
• Support risk acceptance and exception management processes

Skills

ISO 27001 knowledge

Audit coordination

Risk management

Governance & reporting

Stakeholder communication

Security control assessment

Education

ISO 27001 Lead Implementer

Lead Auditor

CISSP

CISM

CRISC

Tools

NIST CSF knowledge

CIS Controls knowledge

Job description

To lead the firm's information security assurance activities, maintain the firm's information security certifications by coordinate of certification activities, and provide independent assessment of security control effectiveness. To also assist in the firm's information security risk management framework, working with the enterprise risk team.

The role helps ensure that security controls continue to protect the organisation, support client commitments and enable the firm to meet its regulatory and contractual obligations within it's risk tolerance.

Main duties and responsibilities

• Own and maintain the ISO 27001:2022 Information Security Management System
• Coordinate internal and external certification audits
• Manage the lifecycle of policies, standards and supporting documentation
• Facilitate management reviews and support continual improvement activities
• Ensure security governance processes remain aligned to business objectives and evolving risk
• Design and operate a programme of security control testing and assurance activities
• Assess the effectiveness of administrative, technical and operational controls
• Produce assurance reports and communicate outcomes to relevant stakeholders
• Monitor remediation activities and support closure of identified weaknesses
• Develop assurance dashboards, metrics and management reporting
• Support the ongoing maturity of the security governance framework
• Review the impact of regulatory, industry and client requirements on the control environment
• Contribute to internal security awareness and governance initiatives
• Support external client requests relating to security assurance and certification activities where required
• Facilitate identification, assessment and evaluation of security risks
• Provide analysis and recommendations to support risk-based decisions
• Monitor risk treatment activities and provide challenge where appropriate
• Support risk acceptance and exception management processes

About you

• Experience operating or supporting an ISO 27001 Information Security Management System
• Knowledge of information security control frameworks and assurance methodologies
• Knowledge of Cyber Essentials Plus
• Ability to assess the effectiveness of security controls and identify improvement opportunities
• Experience coordinating audit, certification or assurance activities
• Ability to translate technical and governance topics into practical business outcomes
• Experience presenting security findings, recommendations and risk information to stakeholders
• Experience identifying, assessing and managing information security risks
• Understanding of information security threats, vulnerabilities and control environments
• Experience applying risk management principles, frameworks and methodologies
• Ability to evaluate the potential business impact of security risks and control gaps

Valuable Experience:

• Internal audit, risk management, compliance, technology assurance or operational resilience experience
• Knowledge of frameworks such as NIST CSF, CIS Controls, SOC 2 or similar industry standards
• Experience within regulated or client-facing environments
• Relevant professional qualifications such as ISO 27001 Lead Implementer, Lead Auditor, CISSP, CISM, CRISC or equivalent

About us

We're a global law firm helping our clients achieve their goals wherever they do business. Our pursuit of innovation has transformed our delivery of legal services. With offices in the Americas, Europe, the Middle East, Africa and Asia Pacific, we deliver exceptional outcomes on cross-border projects, critical transactions and high-stakes disputes.

At DLA Piper, we understand that inclusion is not a one-size-fits-all concept. We embrace and celebrate the range of perspectives, backgrounds and experiences that each individual brings to our firm. By fostering a culture that welcomes and appreciates all aspects of our individuality, we ensure that everyone has the opportunity to succeed.

Our commitment to inclusion and positive social impact enables us to provide exceptional service to our clients and communities, while nurturing a unique and inclusive culture for all our people. We welcome the unique contribution that you will bring to our firm and actively encourage applications from all talented people – however your talent is packaged, whatever your background or circumstance and regardless of how you identify.

We are committed to being accessible and accommodating any reasonable adjustments needed throughout the recruitment process to ensure an inclusive experience for all. If you need any support or adjustments, please let us know.

Where local legislation permits, we will conduct relevant pre-engagement screening checks prior to your first day.

London, United Kingdom
Leeds, United Kingdom

Requesting Adjustments

At DLA Piper, we aim to make meaningful progress and build an inclusive culture where anyone affected by disability, neurodiversity or a long-term health condition has an equitable and accessible chance of success. If you think you may need adjustments or additional support to enable you to participate in our recruitment process, please contact our Recruitment team and we will be happy to support you.

Agile Working

We recognise that people have responsibilities and interests outside of their career and that as a business, we all benefit from working flexibly. That's why we are open to discussing with candidates the different ways in which we are able to support requests for agile working arrangements.

Pre-engagement Screening

In the event that we make an offer to you, and where local legislation permits, we will conduct pre-engagement screening checks that may include but are not limited to your professional and academic qualifications, your eligibility to work in the relevant jurisdiction, any criminal records, your financial stability, and references from previous employers.

Our hiring approach

Our hiring approach enables us to learn about the professional and person you are, and gives you the opportunity to learn about us. Your recruitment experience can differ depending on the type of role you are interviewing for. You will always meet your direct Line Manager for your role, as well as peers and close collaborators for the position. For some of our roles we may also use assessment tools, practical exercises, and panel presentations. Your Recruitment Business Partner will inform you of the recruitment process at the start of any recruitment process, but please let us know if you have any questions prior to making an application.

We're redefining what an international law firm can be. With a unique global network and an unparalleled range of expertise, this is where you'll work on the cases that shape the world and will define your career.

Staying in touch with like-minded people is important to us.Our Talent Community provides unique access to our firm so you can discover why we are a different kind of law firm.

We pride ourselves on the extraordinary impact we make beyond the borders of traditional law. That's only possible because of the skills our business professionals bring and the environment we create to let them thrive. See where your skills could take you.