Support the development and implementation of the Information Security Strategy.
Work alongside business units to assist in implementing appropriate corporate controls in line with the ISO/IEC 27001:2013, PCI, SOC standards.
Contribute to the creation and maintenance of the Information Security Policies.
Contribute to the security review of Contracts, Terms and Conditions and Non-Disclosure Agreements.
Assist with regular security issues and incidents investigations reported to the team.
Contribute to the creation and maintenance of a cyber incident management plan which is tested twice yearly.
Take part in an on-call rota, ensuring prompt investigation and resolution of client incidents.
Assist with the identification of security risks and treatment plans.
Conduct security impact assessments to understand the level of risk Bede information systems are being exposed to.
Support due-diligence activities on 3rd parties as part of Vendor Risk Management.
Support the development, maintenance and communication of our security awareness programme.
Take an active role in the management of security systems including Vulnerability Management, DLP, IDS/IPS, AV, SIEM, Firewalls and other network security systems, Endpoint Protection and Device Control systems.
Measure the effectiveness of security controls through metrics and KPI’s.
Providing technical reporting to Head of Information on control performance.
Requirements
Extensive experience in Information Security or a related security-focused IT position.
Excellent understanding of technical security controls, processes and cloud services.
Information Security Impact Assessments.
Effective written and verbal communication (procedure documentation and management reporting).
Self motivated and able to work independently.
Collaboration (effective team player).
Knowledge of industry standards: ISO 27001, NIST 800-53/CSF, PCI-DSS, Cyber Essentials, Mitre ATT&CK.