Information Technology Security Specialist

Information Security (GRC) specialistLondon market insurance firmHybrid working (1-3 days a week in London)Role overviewYou’ll report to the senior leader responsible for security governance and risk. You’ll help plan, coordinate, track and report on the organisation’s information security activity. As a specialist, you’ll advise on how security systems, policies and procedures are designed and applied, working alongside IT teams and business units so that company data stays protected from security threats.What you’ll doHelp keep the security strategy aligned with wider business goalsWork with IT and the business so security principles and policies are built into projects, culture and day-to-day behaviourSupport the handling of security risk assessments and auditsHelp mature and run robust security governance processesMonitor and manage security risk, encourage good practice, and report to ensure risk stays at an acceptable levelSupport security compliance obligations and the assurance that controls perform as intendedAct as the go-to point of security expertise across the organisationGovernanceHelp develop, align and roll out the security strategyDraft, review and maintain security policiesSupport an ongoing security awareness programme, and deliver training where neededMake sure policies, procedures and standards are accessible and understood by employees, contractors and suppliersAttend relevant governance forums so risk is managed transparently and effectivelyPull together audit findings and drive remediation through to closureBuild management dashboards that show the organisation’s security risk positionAct as the business’s subject matter specialist on securityFoster a culture where information and systems are actively protectedRiskHelp maintain the security risk register, ensuring risks are actively managed or any exceptions are approved and recordedRun security risk assessments and workshopsKeep risk governance and control frameworks current, and escalate issues appropriatelyReview, challenge and track the delivery and effectiveness of controls and mitigation plans arising from assessmentsMake sure any vulnerability that could expose information or systems gets proper management attentionLog and monitor security incidents, checking that mitigations are proportionate and exposure is kept lowSupport incident response as neededDrive continuous improvement in security servicesComplianceMonitor relevant laws, regulations, standards and frameworks that affect information securityAssess how well key controls perform and comply, including access management, identity and authentication, system and network protection, configuration management, vulnerability management and incident responseOwn and maintain a year-long, rolling compliance calendarAbout youDemonstrable background in security governance, risk and complianceStrong cyber risk knowledge, with experience across several frameworks and standards