Information Security (GRC) Specialist

About BMS GroupBMS is a dynamic, independent, global broker established in 1980, delivering specialist insurance, reinsurance, and capital markets advisory services. We are a global brand with offices located across the US, Canada, Latin America, Australia, Europe and Asia with both a strong, local focus and understanding of market needs.Our teams are respected globally for their specialist market knowledge, intelligent analysis and insight. Our people strive to be ‘the best in class’ and with an innovative approach and their entrepreneurial thinking, our clients truly benefit from better solutions to policy development and placement.Being independent makes a key difference to our clients, giving our brokers the freedom to deliver the best solutions, tailored to meet their business needs. Coupled with our collaborative team approach, single platform worldwide and renowned personal service, we are the independent broker of choice.Summary of PositionThis position will work for the Head of Security GRC & Deputy CISO to plan, schedule, monitor and report on activities relating to information security. As an information security specialist, you will be providing subject matter expertise in the design, implementation, and application of BMS information security systems, policies, and procedures. You will work closely with other IT professionals and specialist business units to ensure that the company's data is protected from Information Security threats.Key Responsibilities & AccountabilitiesSupports the ongoing alignment of Information Security strategy to business objectivesEngage with IT and wider business in ensuring the information security principle and policies are built into every aspect of our business from Projects through to culture and behaviours.Play a key role in supporting the ongoing management and response to Information security Risks assessments and auditsContinue to develop and deliver robust security governance processes across the businessTrack and manage information security risk to ensure we drive good behaviours and report on risk to ensure it operates to an acceptable levelSupport BMS’s overall security compliance requirements and related assurance of control performanceProvide a focal point within BMS Group for information security expertiseGovernanceSupport the Head of Security GRC & Deputy CISO with the development, alignment and implementation of the Information Security StrategyDevelopment, review and alignment of Information Security PoliciesSupport the development and delivery of an ongoing information security awareness programmeEnsure InfoSec policies, procedures and standards are accessible, communicated and understood by staff, contractors and vendors. Where required this will include delivering trainingAttendance of relevant governance groups within BMS to ensure complete, transparent and effective risk management is deliveredConsolidating information security audit actions and driving remediation and closureProducing management information (Dashboard) that clearly reflects BMS’s information security risk profileAct as an Information Security subject matter specialist to the businessEstablish mechanisms, behaviours and culture to encourage the protection of BMS information and information systemsRiskSupport the management and maintenance of the Information Security Risk Register, ensuring risks are actively managed or exemptions are managed and recorded.Completion of Information Security risk assessments and workshops.Ensuring that Information Security risk governance and control frameworks are maintained and that risks & issues are reported and escalated appropriately.Review, challenge and track the implementation and effectiveness of controls and risk mitigation treatment plans as a result of a risk assessmentEnsure appropriate management focus for any vulnerability that could expose BMS information or information systems.Track and record information security incidents and to ensure risk mitigation controls are appropriate and proportionate and that exposure is minimized.Support the Information Security Incident response process as requiredFacilitate a process of continuous improvement in the delivery of Information Security services to BMS GroupComplianceTrack requirements and compliance with relevant legislation, regulations, standards and frameworks as they pertain to Information SecurityMeasure the performance and compliance of key BMS controls which include (but are not limited to):Access controlIdentification and AuthenticationSystem and Communication ProtectionConfiguration ManagementVulnerability managementIncident responseManagement and maintenance of a rolling 12-month compliance scheduleWhat we’re looking forProven experience in Information Security GRC functionsCyber Risk expert (experience of multiple frameworks and standards)Able to work with technical and wider business colleagues in driving good business outcomes that align with business risk appetiteExcellent writing and communication skillsSignificant experience and success in managing multiple issues, problems and work streams with a clear ability to prioritiseExcellent understanding of general Information Security concepts and principalsExposure to cyber incident management frameworks and recovery concepts.Experience developing and maintaining written security controls, compliance monitoring, and defining treatment strategies.Expert knowledge of regulations and industry standards as applicable to the insurance sector (e.g. NIST Cybersecurity Framework, GDPR, DORA, SWIFT etc)Personally demonstrate the five BMS values and ensure that team members are aligned with these:We put clients firstWe work as oneWe find a wayWe sweat the detailsWe take ownershipWhat’s in it for me?This is a permanent role, offering a competitive salary and bonus, 27 days holiday, plus access to our personalised benefits platform, Your Rewards, including:comprehensive private medical cover for you and your dependentscomplimentary annual health checksaccess to a virtual 24hr GPgym subsidy & dedicated wellbeing supportretail discountsopportunity to purchase equitydefined contribution pensionextra day’s leave to celebrate your birthdayThrough our Diversity, Equality and Inclusion (DEI) vision, we are committed to ‘building a culture of belonging for all, valuing diverse perspectives and embracing authenticity.’ As such, we have created our ‘BMS Together’ programme, with dedicated training, collaborative committees and intentional partnerships. In support of our ESG vision, we offer two additional paid days each year to take part in charitable work.BMS offers flexible and hybrid working policies and we’re happy to discuss options with you upon application. Please let our team know if you require any adjustments to support you through the application process.