Information Security and Compliance Manager

As Info Sec Manager you'll play a vital role in the team taking responsibility for policies, procedures and controls that will protect their data and systems. Your work will directly impact our ability to support the armed forces community with confidence - allowing you to make a difference every day to come to work.

Role Purpose:
The Information Security and Compliance Manager is responsible for developing, implementing, and maintaining security policies, procedures, and controls to protect the Royal British Legion's data and systems. They will play a pivotal role in the management and containment of security incidents, ensuring continuous improvement in their security posture while raising awareness for staff, volunteer and member communities. The post holder will lead on activities that assess, report and mitigate risk associated with third parties with the focus being to protect the confidentiality, integrity, and availability of their information assets.

Key Responsibilities:
Information Protection

• Take responsibility for their information and data protection policies, practices and settings to include sensitivity labels, data retention policies and data loss protection policies
• Collaborate with the Head of Risk, DPO and VCISO to identify and manage information security risks and mitigating controls
• Lead the wider business areas to ensure security policies and procedures are embedded in all business processes.
• Collaborate with internal comms to ensure implemented information protection policies are understood and accepted by the wider organisation
• Take an active role in in the containment and reporting of information security incidents, including detection, response, remediation and communication.

Third Party risk management

• Lead on the design and implementation of robust processes for reviewing & addressing the data security posture of third-party suppliers.
• Take a leading role in managing their relationships with vendors and service providers to assess compliance with security and data protection policies and standards.

Policy, Audit & Reporting

• Take the lead on the review process for information security policies working to agreed re-view schedules. Ensure all policies are published and made available to all staff and volunteers increasing awareness among these groups.
• Develop their policies and procedures in accordance with industry regulations and standards such as Data Protection Act 2018, PCI-DSS, and ISO27001.
• Monitor tools for data governance, data security, and compliance to manage information security risks and regulatory requirements and detect and investigate possible information security incidents.
• Actively contribute to the production of the scheduled security assurance reports for Executive Board and Finance Committee.
• Deliver accurate reporting against the Security Strategy deliverables ensuring close alignment against strategic and departmental objectives.

Knowledge & Experience

• Significant proven experience in information security and compliance management.
• Familiarity with ITIL practices and risk management methodologies.
• Significant proven experience with cyber security incident management and response
• Strong knowledge of security standards and regulations, such as GDPR, PCI-DSS, and ISO27001
• Experience of delivering data protections specifically data loss prevention, sensitivity labelling and retention (using Microsoft Purview)
• Experience of managing projects through to completion

Skills & Attributes

• Excellent problem-solving skills and the ability to provide technical expertise and advice - Strong all round technical skills
• Strong communication and collaboration skills & proven ability to work effectively with various departments including senior leaders.
• Ability to explain technical solutions to a non-technical audience
• Ability to manage and organise own workload and be flexible and ready to adapt to changing demands
• Strong analytical skills with the proven ability to (use) on the data available to inform decisions and actions

Qualifications
Certified in one of the following:

• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified Information Systems Auditor (CISA)
• Certified in Risk and Information Systems Control (CRISC)
• ISO/IEC 27001 Lead Implementer