Lead Security Assurance Specialist

About Network Rail

At Network Rail, our passengers and freight users are at the heart of everything we do. We help connect people to their friends and families and get goods to their destination safely and efficiently. We\’re an organisation where people matter. Watch our video to find out more!

Scotland\’s Railway is part of this large family and it covers a large geographical area from the Borders to Thurso at the far tip of the North East of Scotland, accounting for almost 20 per cent of the UK rail network. We provide rapid access along busy commuter routes to our seven cities, servicing the varied needs of our business and leisure commuter services, including cross border services and rural services. We have up to 50 freight services operating every day and we are steadily building capacity for this to grow. Our ambition to be responsive to passengers and freight users, drives us every day and we\’re empowered to do the right thing for those who use the rail network. We actively challenge unsafe practices and take responsibility for addressing risks, resolving issues and protecting safety and wellbeing.

Our colleagues are encouraged to work flexibly as we know that busy lives don\’t always fit around a traditional working pattern. If you need flexibility to complete your role, just let us know and we will do our utmost to help you invest in your career with us while balancing other aspects of your life.

We\’re also a Disability Confident Leader employer, and we\’ll try our best to adapt the process and offer reasonable alternatives to support people with disabilities access, apply, and interview for roles.

We want to help deliver a railway which is safe, reliable, affordable, and provides great customer service to everyone. For more information about Network Rail, click here.

Brief Description

The Engineering & Asset Management function of Scotland\’s railway focuses on providing high-caliber engineering services that underpin the delivery of a safe, high-performing railway network. Managing our infrastructure and assets needs careful planning, aligning objectives and activities which are delivered efficiently and sustainably, within budget.

This position offers the chance to advance our cyber security maturity. The successful candidate will serve as the primary point of contact and informed client for Scotland\’s Railway. Responsibilities include supporting national cyber security initiatives, developing and implementing a cyber security maturity improvement plan, creating a compliance plan for relevant standards, addressing audit actions, and documenting our approach to cyber security in line with the national strategy.

The initial phase will focus on Operational Technology, aiming to achieve incremental and practical improvements that deliver appropriate cyber security capabilities and maturity. After initial phases, the role is expected to expand to cover all aspects of cyber security.

About the role (External)

What to expect

• Management and delivery of security assurance activities, including security surveys, audits, verifications, and self-assurance assessments according to the NR assurance framework.
• Support the delivery of the security assurance plan to demonstrate compliance with regulatory, legal, and Network Rail standards and risk processes.
• Manage and conduct security threat and risk assessments to identify control failures and deliver risk management aligned with the NR security assurance framework.
• Present audit recommendations to management, secure commitment for implementation, and monitor post-audit actions.
• Supervise and conduct security engineering accreditation to support lifecycle security assurance of railway systems.
• Investigate reported cyber security incidents, compile reports, and recommend controls to address procedural or technical failures.
• Support the Security Assurance Manager in collaborating with external assurance providers to maintain compliance with security standards.
• Assist in maintaining security policies, standards, and promoting security awareness and training.
• Develop team competencies and training requirements.

What We\’re Looking For

Essential qualifications and experience include:

• Qualified ISO27001 Lead Auditor or relevant security compliance experience.
• Knowledge of security assurance standards such as CAS(T), ISO 27001, IEC 62443, or similar.
• Experience in security assurance certifications or UK government security accreditation.
• Experience in information security audits and risk assessments.
• Experience in auditing security domains like vulnerability assessments, access controls, third-party due diligence, business impact analysis, firewall compliance, network security, logical system security, and encryption technologies.

We prioritize your well-being with comprehensive benefits and support flexible working arrangements. Locations include Leeds, Glasgow, Edinburgh, and Greater Manchester. Competitive salary and benefits are offered.

#J-18808-Ljbffr