Head of Cyber Security

Job Introduction

• Compassionate – we show kindness, consideration and understanding in everything we do – and demonstrate our caring nature to our patient, people, and communities.
• Accomplished – we are available day and night – a response, adaptable, professional NHS partner, providing the best advice, care, and treatment for every individual.
• Respectful – we recognise the value that individual and team difference bring – welcoming views, listening, being honest, and learning from others’ experiences.
• Encouraging – we believe everyone matters, so we inspire confidence in other – promoting ‘speaking up’, fostering career-long learning and development, and supporting improvement ideas.

• Delivery of a cyber safe and compliant environment with ability to deliver assurance to the business.
• Manage, monitor, and improve business processes towards the delivery of a safe cyber environment for the business.
• Lead, support and deliver certification / assurance of nationally mandated requirements of DSPT, CyberEssentials & Cyber related ISO standards.
• To act as the designated specialist on Cyber Security for the Business and to provide an expert specialist advice service, in accordance with national and local digital security standards and best practice.
• Has good technical understanding and the aptitude to remain up to date with digital security developments. Possesses an in-depth understanding of the digital security services used by the Business.  Is effective and persuasive in both non-technical language written and oral communication.
• Uses security management systems software and appropriate analysis equipment to collect routine threat statistics to model Business vulnerabilities, creating management reports, including proposals for improvement.
• Investigates and diagnoses complex security problems, working with users, other staff, and suppliers as appropriate to maintain the integrity of the Business’s digital security.
• Possess a broad understanding of business and technical issues. Possesses well developed management skills, with particular emphasis on interpersonal skills and the ability to motivate staff. Shows the ability to delegate effectively to technical staff, whilst maintaining full management control. Demonstrates the special leadership skills needed to handle innovation and change resulting from the implementation of new security solutions and services.
• Possess the ability to analyse, interpret and resolve highly complex digital security problems where there is no precedent and where other leading opinions may conflict, against a backdrop of changing operational priorities.      
• To be responsible for the development, production, review, and update of Digital related security documentation including, and not limited to:

• Educated to master’s degree level, equivalent in an IT professional qualification or equivalent experience. 
• Qualification in Information / Cyber Security (CISB, CISSP) or equivalent experience. 
• Extensive experience of managing security improvement programmes within a healthcare / NHS setting 
• Experience of developing Information Security policies in a complex environment where confidential information is stored.
• Experience of delivering an Information Security service to a large complex organisation using confidential information 
• Prior experience performing security reviews and risk assessment. 
• Experience of managing cyber incidents, response, and actions 
• Ability to generate statistics/analysis and write reports on Business security environment. 
• Knowledge of the Information Governance Toolkit (or equivalent standards) 
• Ability to explain complex technical or legal issues to a non-technical audience (Essential)
• Ability to prepare and produce concise yet insightful communications for dissemination to senior stakeholders and a broad range of stakeholders as required (Essential)
• Ability to analyse very complex issues where material is conflicting and drawn from multiple sources. 
• Experience of setting up and implementing internal policies, processes, and procedures
• Knowledge of common technologies such as Windows OS, email infrastructure, datacentres, network administration 
• Demonstrated ability to perform phishing and Malware analysis. 
• System and/or network administration (Windows/UNIX/Cisco) 

• Project Management Knowledge (Prince 2)
• Certified Ethical Hacker
• Experience of NHS structures and systems
• Contract & supplier management
• Understanding of the role of health informatics
• Appreciation of the strategic implications of IM&T in the NHS & Associated Healthcare providers
• Appreciation of common Healthcare HR policies, Health & Safety policies, Data Protection Act, Freedom of Information Act, Caldicott guidelines
• Car owner