Information Security Manager

Ward Hadaway Llp; Newcastle upon Tyne, Leeds; On-site; GBP 75,000 - 110,000; Full time

Benefits offered by this job

Enhanced pension

25 days' annual leave + bank holidays

Life assurance

Health and wellbeing benefits

Hybrid working

Flexible benefits

Job summary

Ward Hadaway Llp is seeking an Information Security Manager to join the Risk and Compliance team, located from Newcastle or Leeds. You will lead information security, data protection and risk initiatives, owning ISO27001 and the Integrated Management System, and collaborate with technology, legal and business teams to protect client, employee and corporate information.

You will develop and implement security governance, conduct risk assessments, and support audits and incident response plans,

Qualifications

• Strong leadership to drive security initiatives in a firmwide context.
• In-depth knowledge of data protection legislation (Data Protection Act 2018, UK and EU GDPR).
• Proven experience in a similar role, preferably within a law firm or professional services environment.
• Expertise in information and cyber security controls, particularly ISO27001, and comprehension of technical IT concepts.
• Robust understanding of technical and organisational security controls, with a keen ability to evaluate and mitigate risks.
• Industry certifications such as CISSP or CISM are highly desirable.
• Exceptional communication skills, with the ability to convey technical issues clearly to diverse audiences.
• Strong relationship-building skills.
• Excellent problem-solving and decision-making skills.
• Proven ability to work both as part of a team and individually with a flexible "can-do" attitude.

Responsibilities

• Lead the firm's risk, compliance, information security and data protection activities, and mentor a small team.
• Own ISO27001 certification and IMS development/operation within a coordinated governance framework.
• Oversee information security risk assessment programmes and develop security and governance initiatives.
• Provide practical, commercial, risk-based information security advice to support firm objectives.
• Coordinate with Technology and Change, Risk and Compliance, GC and other stakeholders on security matters.
• Plan and support internal and external audits, assurance activities and corrective actions.
• Support cyber security from an information security perspective and advise on AI tool usage.

Skills

Leadership

Data protection laws

Experience in similar role

ISO27001

Security controls

CISSP or CISM

Communication skills

Relationship building

Problem solving

Teamwork

Job description

We are looking for an Information Security Manager to join our Risk and Compliance team to be located from either our Newcastle or Leeds office.

The successful candidate will be expected to work with the wider firm to deliver a commercial, pragmatic, effective and risk-based approach to activities that provide appropriate access to, and protect the confidentiality, availability and integrity of client, employee, and corporate information. You will also work with the firm's Technology and Change Team on an on-going basis to provide advice and consultancy regarding the information security implications of any software and hardware implementations, changes and upgrades.

There will also be some involvement in advising and drafting of information security policies, monitoring compliance, providing assistance in relation to the assessment of cyber security risks, mitigation initiatives and assisting with the firm’s incident response plans.

What will I be doing?

You’ll support the Director of Risk & Compliance in leading the firm's risk, compliance, information security and data protection activities, whilst managing a small team and driving a culture of continual improvement across the business. You’ll own all aspects of the firm’s ISO27001 certification in addition to owning the ongoing development and operation of the firm’s Integrated Management System (IMS) ensuring that information security, risk management, compliance and assurance processes operate effectively within a coordinated governance framework. You will oversee an ongoing information security risk assessment programme, alongside developing and implementing and security and governance initiatives.

Working collaboratively with the firm's Technology and Change, Risk and Compliance, General Counsel, and wider teams and key stakeholders across the business, the role will provide practical, commercial and risk-based information security advice to support the firm's objectives and protect client, employee and corporate information.

The role will play a key part in supporting the firm’s risk, compliance and information security objectives, including, but not limited to:

• Leading, developing and mentoring a small high-performing team.
• Information security governance and assurance.
• Information security incidents and data breaches.
• Supporting the development and implementation of the firm's risk management framework, controls and governance arrangements.
• Conducting supplier and third-party due diligence, including security, data protection and risk assessments.
• Managing the firm's ISO 27001 programme with the support of an Information Security Analyst.
• Overseeing information security, information governance and data protection programmes, ensuring compliance with legal, regulatory and business requirements.
• Planning, coordinating and supporting internal and external audits, assurance activities and the effective management of corrective actions.
• Supporting cyber security from an information security perspective.
• Delivering training, guidance and awareness initiatives to strengthen risk, compliance and information security culture across the firm.
• Supporting business continuity, disaster recovery and cyber resilience activities.
• Providing information security advice and guidance to support the firm’s adoption and use of AI tools and technologies.
• Working with our General Counsel team on personal data breaches, providing information security advice and support where required.

You’ll have

• Strong leadership in driving security initiatives within a firmwide context.
• In-depth knowledge of data protection legislation (Data Protection Act 2018, UK and EU GDPR).
• Proven experience in a similar role, preferably within a law firm or professional services environment.
• Expertise in information and cyber security controls, particularly ISO27001, and comprehension of technical IT concepts.
• Robust understanding of technical and organisational security controls, with a keen ability to evaluate and mitigate risks.
• Industry certifications such as CISSP or CISM are highly desirable.
• Exceptional communication skills, with the ability to convey technical issues clearly to diverse audiences.
• Strong relationship-building skills.
• Excellent problem-solving and decision-making skills.
• Proven ability to work both as part of a team and individually with a flexible "can-do" attitude.

About us

We’re proud to be an independent, full-service law firm providing exceptional legal expertise to businesses, the built environment, healthcare, the public and third sectors, and private individuals. With several office locations around the UK we’re one of the UK's Top 100 law firms. When you join us you’ll be part of a team of over 500 passionate and talented individuals who take pride in offering an exciting and supportive environment allowing you to thrive.

We’re passionate about promoting wellbeing and equality, diversity and inclusion, with dedicated committees to support ongoing efforts. We recognise that a healthy and thriving Firm filled with individuality and differences strengthens our teams, our clients and our communities.

What we can offer you

We’re committed to being a firm focused on support, development, wellbeing and inclusion and we’re always striving to improve. Our commitment to this has been recognised by our achievement of our Gold Investors in People award and by our Hive HR Employee Voice certification.

• We reward our people with a whole range of benefits, some core and some flexible, designed to shape a reward package that’s right for you – now and in the future. Our core benefits include:
• An enhanced pension scheme with employer matched contributions of up to 6%.
• 25 days' annual leave + bank holidays (increasing to 28 days with length of service). There is also the option to purchase up to 5 additional days.
• Life assurance cover of 4 times basic salary, with the option to purchase additional cover.
• A range of health and wellbeing benefits.
• Hybrid working with a minimum requirement of 2 days per week working from one of our offices.
• We also have a flexible benefits programme where you can purchase a wide range of additional benefits.