Information Security and Data Protection ManagerMinistry of Justice

23825

Descriptions & requirements

Job description

Job Title:     Information Security and Data Protection Manager

Grade:          HEO

Directorate: Cyber Security

Location:   National

Contract Type: Permanent

Working Pattern: Full-time/ Flexible Working

Successful applicants will be expected to be office based 3 days per week in any HMCTS Office (subject to business availability)

Introduction

HM Courts & Tribunals Service (HMCTS) is responsible for the administration of criminal, civil and family courts and tribunals in England and Wales. Our roles support our service users and colleagues, where people and businesses access potentially life-changing justice.  We’re looking for individuals who are committed to public service and want to make a difference in people’s lives in delivering justice. If you’re interested in developing a career with a real purpose, please apply.

Job Description

As Information Security and Data Protection Manager you will be responsible for supporting the delivery of information security and data protection objectives. You will be responsible for supporting HMCTS to meet its obligations under data protection and information legislation including UK GDPR, Data Protection Act 2018, Public Records Act 1958 and relevant MoJ/HMCTS data protection and information security policy frameworks. You will support with the maintenance and update of the Information Security Management System (ISMS).  As Information Security and Data Protection Manager you will support with security assurance activities, including audits, reviews, risk assessments, and compliance monitoring. You will work with a range of stakeholders including the MoJ Data Protection Team (DPT), Data Incidents Team, Service Owners, Information Asset Owners, delivery teams, digital and technology colleagues, and cyber security specialists. You will help identify and mitigate information security, and data protection risks early and provides general data protection and information security advice, to support a culture of excellence and transparency in how personal data and information is managed across HMCTS.

In this role you will

Your role as Security and Data Protection Manager will encompass several key responsibilities listed below (but not limited to):

Supporting the effective maintenance and operation of the Information Security Management System (ISMS)

Delivering assigned security and data protection improvement activities to agreed timescales

The provision of expert advice and support in relation to data protection and information security to a range of stakeholders across HMCTS ensuring accurate advice is provided and tailored to the needs of the audience

Support stakeholders to identify when a DPIA/MOU/DSA is required to support the delivery of their business objectives whilst maintaining regulatory compliance

Responsibility for making recommendations in relation to DPIAS, DSAs and MOUs and consulting with colleagues to ensure that there is an appropriate level of assurance and oversight

Identify and escalation of recurring data protection and information security issues and propose improvements to guidance, templates and ways of working

Produce clear management information to highlight volumes, risks and trends and other ad-hoc reporting as required

Support the HMCTS Information Security Lead to develop and manage a quality service to stakeholders and monitor compliance with internal controls

Collaborative engagement across HMCTS including the Data Incidents Team, Security Architects, Cyber Security Risk Teams, and Data Access Panel including maintaining a strong relationship with the MoJ Data Protection and Security Teams

Support with assurance and compliance activities relating to data protection and information security in line with business plans and objectives

Maintain information security policies, standards, procedures, and guidance, ensuring they remain current and fit for purpose

Track and report on security risks, incidents, vulnerabilities, audit actions, and control effectiveness.

Coordination of activity for DPIAs/DSAs and MOUs, maintaining records of status, approval and reviewing for clarity, completeness and proportionality ensuring risks and mitigations are clearly articulated and requesting additional information or clarification as required

Coordination of the HMCTS data protection shared mailbox ensuring that all emails are dealt with in a timely manner including assigning emails to other team members and escalation or redirection as required

Essential skills

Experience working in information security, data protection, governance, risk, compliance, or a related field

Working knowledge of legislative requirements such as the UK GDPR, Data Protection Act 2018 and Public Records Act

Experience supporting the delivery of information security risk or compliance improvement activities

Provision of clear advice and support to non-technical stakeholders

Proven communication skills with the ability to explain risks, impacts and mitigations clearly and proportionately

Ability to manage multiple pieces of work with good time management skills

Experience of providing constructive challenge and feedback while maintaining positive working relationships

Strong organisational and administrative skills with good attention to detail

Experience of engaging and working with a range of teams and stakeholders to solve problems and provide strong outcomes

The ability to compile information and reporting in an easy-to-understand manner and contribute to the continuous improvement of processes

Understanding of information security risk management concepts.

The below criteria are desirable only. These will not be assessed throughout the recruitment process, but will be used in the event of tied scores between candidates

Desirable skills

Experience of using One Trust or similar Governance Risk and Compliance Platforms

Experience of DPIAS, MOUS and DSAS in practice

Experience supporting audits, risk assessments, or compliance reviews.

Knowledge of security frameworks and standards such as ISO 27001, NIST, CAF, Gov Assure 007

Application process:

Stage 1 - Sift:

To apply for this position, you must submit the following as part of your application:

An anonymised CV, setting out your career history, key responsibilities and achievements. Your CV will be assessed against the essential criteria outlined within the Essential Skills section of this advert.

A Statement of Suitability which should give us real life examples of how your skills and experience match those needed for this role. We recommend following the STAR format.

Should we receive a high volume of applications, a pre-sift may be conducted on the CV. Candidates who pass the pre-sift will be fully assessed on all the sift criteria.

Please access the following link for guidance on how to apply - Application Guidance

Stage 2 - Interviews:

Successful candidates who passed the sift will be invited to interview via Microsoft Teams. At interview stage, you will be assessed against the following - Strengths and Behaviours:

Making Effective Decisions

Delivering at Pace

Working together

Communicating and influencing

Details can be found under the interview stage assessment section on the advert.

For further guidance on the interview process please click here

Important information

Salary details

New recruits to the Civil Service joining MoJ are expected to join at the band minimum.

Existing Civil Servants applying on promotion, will usually be appointed on the salary minimum of the new pay band, or receive an increase of 10 percent on the current base salary, whichever is higher (This is restricted to the pay maximum of the new band).

Travel requirements

There will be a requirement to travel occasionally to any HMCTS site in line with business needs.

Proud to Serve. Proud to keep justice going.