Information Technology Security Specialist

MJA (London) Limited; City Of London; Hybrid; GBP 70,000 - 100,000; Full time

Job summary

MJA (London) Limited is seeking a Security Governance, Risk and Compliance specialist to plan, coordinate, track and report on information security activities. You’ll advise on how security policies and procedures are designed and applied, working with IT and business units to protect company data.

You’ll help mature governance processes, manage risk, and support audits while reporting on risk position and compliance obligations. Hybrid working in London.

Qualifications

• Demonstrable background in security governance, risk and compliance.
• Strong cyber risk knowledge, with experience across several frameworks and standards.

Responsibilities

• Help keep the security strategy aligned with wider business goals.
• Work with IT and the business so security principles and policies are built into projects, culture and day-to-day behaviour.
• Support the handling of security risk assessments and audits.
• Help mature and run robust security governance processes.
• Monitor and manage security risk, encourage good practice, and report to ensure risk stays at an acceptable level.
• Support security compliance obligations and the assurance that controls perform as intended.
• Act as the go-to point of security expertise across the organisation.
• Pull together audit findings and drive remediation through to closure.
• Build management dashboards that show the organisation’s security risk position.

Skills

Security governance

Risk management

Compliance

Cyber risk

Job description

Hybrid working (1-3 days a week in London)

Role overview

You’ll report to the senior leader responsible for security governance and risk. You’ll help plan, coordinate, track and report on the organisation’s information security activity. As a specialist, you’ll advise on how security systems, policies and procedures are designed and applied, working alongside IT teams and business units so that company data stays protected from security threats.

What you’ll do

• Help keep the security strategy aligned with wider business goals
• Work with IT and the business so security principles and policies are built into projects, culture and day-to-day behaviour
• Support the handling of security risk assessments and audits
• Help mature and run robust security governance processes
• Monitor and manage security risk, encourage good practice, and report to ensure risk stays at an acceptable level
• Support security compliance obligations and the assurance that controls perform as intended
• Act as the go-to point of security expertise across the organisation

Governance

• Help develop, align and roll out the security strategy
• Draft, review and maintain security policies
• Support an ongoing security awareness programme, and deliver training where needed
• Make sure policies, procedures and standards are accessible and understood by employees, contractors and suppliers
• Attend relevant governance forums so risk is managed transparently and effectively
• Pull together audit findings and drive remediation through to closure
• Build management dashboards that show the organisation’s security risk position
• Act as the business’s subject matter specialist on security
• Foster a culture where information and systems are actively protected

Risk

• Help maintain the security risk register, ensuring risks are actively managed or any exceptions are approved and recorded
• Run security risk assessments and workshops
• Keep risk governance and control frameworks current, and escape issues appropriately
• Review, challenge and track the delivery and effectiveness of controls and mitigation plans arising from assessments
• Make sure any vulnerability that could expose information or systems gets proper management attention
• Log and monitor security incidents, checking that mitigations are proportionate and exposure is kept low
• Support incident response as needed
• Drive continuous improvement in security services

Compliance

• Monitor relevant laws, regulations, standards and frameworks that affect information security
• Assess how well key controls perform and comply, including access management, identity and authentication, system and network protection, configuration management, vulnerability management and incident response
• Own and maintain a year-long, rolling compliance calendar

About you

• Demonstrable background in security governance, risk and compliance
• Strong cyber risk knowledge, with experience across several frameworks and standards