Full job descriptionInformation Security Specialist (Hybrid)
Hybrid Working with 2 days in Preston, Lancashire
£45,000 - £50,000 per annum, plus benefits - 37 hours a week

A glance at the role:

Join LPPA as our Information Security Specialist and take a leading role in strengthening how we govern, assess and assure information security risk across the organisation. Working within Risk & Governance, you will provide specialist advice and constructive challenge on security risks, controls, third-party assurance, incidents and organisational resilience. You will work closely with Technology, project teams and business owners, translating complex technical information into clear business risks and assurance for senior leaders and governance forums. You will also take responsibility for LPPA’s ISO 27001 reaccreditation process.

This is a fantastic opportunity to join our fast-paced, collaborative and member-focused business. You will be part of a friendly, welcoming and sociable work culture, with opportunities for continuous personal and professional development and support to reach your full potential.

A bit about us:

Local Pensions Partnership Administration (LPPA) is a multi-award-winning organisation and one of the UK’s leading pension administration companies. We strive to deliver the best experience for over 1,500 employers and more than 738,000 members of Local Government, Police and Firefighter pension schemes, keeping them fully informed about their pensions whilst working closely with employers to continuously educate and support them.

What we can offer you:

- Competitive salary of £45,000 - £50,000 per annum.
- 25 days’ holiday, plus bank holidays and 2 additional concessionary days and 1 day for your Birthday, with the ability to ’buy and sell leave.
- Access to an excellent pension scheme (Local Government Pension Scheme) with generous employer contributions.
- Access to a Health or Dental Plan.
- Access to our Enhanced Employee Assistance Programme for when you might need some support.
- The opportunity to earn through our Employee Referral Scheme.
- Access to our bespoke Reward Discount Scheme – ’Your Perk Site.’
- Opportunities to attend Wellbeing webinars and social events.
- Daily free fruit and snacks available to you in our office.
- Free Car Parking in Preston City Centre.

What you’ll be doing:

- Lead the development and continuous improvement of LPPA’s information security management framework, policies, standards and supporting procedures.
- Maintain LPPA’s information security risk profile, ensuring risks are recorded, assessed, owned, monitored and reported through the appropriate governance arrangements.
- Provide authoritative advice and constructive challenge to Technology, project teams and business owners on security risks and their treatment.
- Lead the information security assurance programme, including control reviews, evidence gathering, thematic assessments and remediation monitoring.
- Assess the design and operation of key information security controls, identify weaknesses and recommend proportionate improvements.
- Lead supplier and third-party security due diligence, reviewing security evidence, certifications, contractual controls, risk assessments and remediation activity.
- Lead the governance and oversight of information security incidents, including assessment, documentation, escalation, investigation and post-incident review.
- Produce information security reports, dashboards and assurance updates for senior management, governance committees and Boards.
- Support business continuity, disaster recovery and operational resilience activity, including cyber incident response and recovery exercises.
- Coordinate with external security advisers, testing providers, auditors and assurance partners.

What we need from you:

- Substantial practical experience in information security governance, security risk management, security assurance or a comparable specialist role.
- Demonstrable experience of leading information security risk assessments or assurance reviews and presenting clear findings and recommendations.
- Experience of assessing technical and organisational security controls, supporting or leading security incidents, and undertaking third-party security due diligence.
- Strong knowledge of information security governance, risk management and assurance principles, with a good understanding of cyber threats, vulnerabilities and common technology risks.
- An understanding of identity and access management, logging and monitoring, vulnerability management, encryption, network security, cloud risk and secure configuration.
- The ability to evaluate conflicting or incomplete evidence, reach a reasoned conclusion and translate technical issues into clear business risks.
- Confidence to challenge technical and senior stakeholders, alongside high standards of integrity, discretion, evidence management and professional judgement.

Nice to have:

- Experience of recognised standards or frameworks such as ISO/IEC 27001, the NCSC Cyber Assessment Framework or equivalent.
- Experience within pensions administration, financial services, local government or another regulated environment.
- Experience of cloud security, Microsoft security environments, security testing, audit liaison or cyber exercise coordination.

Qualifications and professional development:

- A relevant information or cyber security qualification, or progress towards one, would be desirable.
- Membership of a relevant professional body would be desirable.

Working with and upholding our values:

- Working together
- Committed to excellence
- Doing the right thing
- Forward-thinking