Information Security and Information Management Risk Manager

at  Adway Associates

A role within The Risk team, supporting the Head of Enterprise and Operational Risk in the oversight of Information Security and IT/Change risks.
The role holder will assist in the provision of second-line oversight and advisory activity across the information security and information management risk categories, the ongoing development of the Society’s risk management framework, and the development of processes and procedures that enable the effective management and reporting of risk across the IS/IM risk categories.
The role holder will also act as a key subject matter expert in the team in relation to IS and IT matters, keeping abreast of the current and future best industry practices and regulatory requirements.

• Provide SME advice to Information Security / Information Management Risk Category Owner or their designated point of contact on the effectiveness of risk management within these risk categories.
• Represent Risk on projects that have a strong IS / IM delivery to ensure that appropriate actions are taken to ensure continued compliance with applicable standards.
• Ensure that risks are appropriately managed throughout the lifecycle of change initiatives by undertaking regular reviews of the risk assessments of in-flight projects agreed with line manager.
• Advise business areas of concerns and recommendations with regard to IS / IM and systems and build strong relationships with all business areas in order to foster excellent team working and support for improved IS / IM management.
• Assist in the ongoing development of relevant forward looking MI to ensure that senior management are fully aware of any risks arising from, or associated with, The Societys operations.
• Analyse and evaluate MI gained from a number of sources, draws conclusions from and recommend actions as a result of this analysis.
• Ensure that robust systems are in place for monitoring IS and IT incidents and that all incidents are recorded and that all evidence related to any incident is recorded and maintained for legal retention periods.Regularly provide an independent, second line view on incidents to appropriate Committees, as required.
• Attend regular training and conferences in order to brief NBS on the latest guidance for dealing with external threats.
• Prepare written reports for the CRO, Head of Enterprise and Operational Risk, and committees as required.
• Undertake any tasks consistent with knowledge, experience and skills, under the direction of the CRO or senior managers within the Risk team, as necessary to support the Risk function or to further the risk management aims of The Society.