Head of Security & Risk, Europe in London

CTM UK is looking for a Head of Security and Risk, a role that can be based in any of our UK locations -

• London, Bradford, Manchester or Glasgow
• . As the role is hybrid

, applicants need to be able to come to one of CTM office 2 days per week.

• This is a new role and we are looking at onboarding the selected candidate in
• Spring 2024

Note that the recruitment process will involve interviews with team members in the USA (late day interviews) and a Security Clearance process.

ABOUT THE ROLE.

The Head of Information Security and Risk position will be responsible for all aspects of security within the assigned area, the company, documenting and escalating information risk.

In addition, this position shall work to enforce the security controls and enhance the company’s security posture.

You shall be instrumental in helping Senior Management establish security controls, enforce security guidelines, and best practices for all company assets and processes.

This will include establishing a cost benefit analysis of security solutions that will accommodate current and future company requirements.

Other areas of responsibility will include vulnerability lifecycle management, the day-to-day maintenance of all security policies, standards, procedures, and supporting documentation as required to ensure the company complies with all statutory and contractual requirements.

You must also sign an annual acknowledgement of the security responsibilities inherent with this position and agree to safeguard the information to which you have been granted trusted access.

SKILLS.

Qualifications

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily.

The requirements listed below are representative of the knowledge, skill, and/or ability required.

Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Ability to read and interpret documents.
• Strong reasoning and communication skills.
• Ability to apply common sense understanding to carry out instructions furnished in written, oral, or diagram form.
• The ability to deal with problems involving several concrete variables in standard situations is required.

Candidate must possess a basic understanding of best practice security processes such as PCI DSS, Cobit, NIST, SOC2 Controls, and an understanding of ISO controls, etc.

Candidate must demonstrate an understanding of modern security solutions, controls, and architectures and work with the associated groups in order to accomplish the security goals of the company.

• Able to assess data management systems.
• Able to manage information collection and produce a professional response.

Excellent knowledge of Security related legal and regulatory requirements, including forthcoming legislation in a timely manner.

• Able to manage information collection and produce a professional response.
• Ability to work in a fast-paced environment, handling multiple priorities, whilst facilitating and directing various business disciplines to deliver to expectation.
• Ability to communicate with individuals at all levels of an organization.
• Strong one-on-one interpersonal skills.
• Ability to set priorities, meet deadlines and work independently.
• Ability to work in a team environment and be open to change.
• Must be able to maintain confidentiality.

EXPERIENCE.

• A Bachelor’s degree in Computer Science with a major in Information Technology is highly recommended. CISSP Certificate is preferred.

Equivalent work experience may be taken into consideration in lieu of degree.

It is strongly preferred applicants possess at least 7 years industry experience within the security, server, networking, and IT Infrastructure environment.

• Its strongly preferred applicants possess at least 5 years of management experience.
• Excellent understanding of security standards/certifications such as SOC 2, ISO 27001, PCI DSS, Cyber Essentials (Plus).
• A good working knowledge of the Travel Industry will be a bonus.
• Working knowledge of the following systems will be advantageous; Abriska, Upguard, Vigilant Software, Crowdstrike, and SIEM environment.
• Good knowledge of the requirements to consolidate information and processes successfully.
• A comprehensive understanding of the practical application of relevant legislation and official guidance relating to processing of personal data.
• Applicants are able to demonstrates their ability to build strong working relationships with their peers and engage with stakeholders successfully, at all levels.
• A security clearance will be carried out for the successful candidate; this is essential.
• Travel and visits to other offices within the region is essential.

KEY OBJECTIVES

• This position has the responsibility of directing the work of others (distributing work to others, reviewing the work of others, assigning persons to specific work and assisting with the training of new employees) and of selecting personnel, ensuring adequate staffing levels and appraising performance.
• You are expected to be organized, ahead of schedule, communicative, and accountable. In short, own your role entirely, while being open to critiques, suggestions, and new ideas.
• Ensure that all systems and processes are compliant with statutory and contractual data security obligations.
• Work with all of the business areas to maintain any security accreditation held.
• Maintain the Information Risk Assessment Matrix and ensure prompt action to mitigate identified risk areas.

CTM is the Data Controller with respect to the personal information you provide during your application.

We will use this information solely to process your application, and our legal basis is that you are considering taking up an employment contract with us.

We may share this information with our parent company in Australia, but otherwise we will not disclose it to any other organisation.

If you take up employment with us, we will keep the information for the duration of your employment, otherwise we will destroy it 2 months after the post is filled.

All the information that we ask for in application forms has to be completed for your application to go ahead.

There is no profiling or automated decision making applied to the personal information you supply.

You have all the legal rights with your personal data as lain out in the General Data Processing Regulation (GDPR) and the Data Protection Act 2018, including the right to complain to the Information Commissioner’s Office.

• Our Data Protection Officer may be contacted at