Job Title: Information Security Manager. What is the purpose of the job? What are the essentials of the job? Reporting To: Head of IT Services

Transcription

1 Team: IT Based: Birmingham Reporting To: Head of IT Services Salary Per Annum: 55,000-65,000 Your job responsibilities at Virgin Trains are outlined below. Expectations of the company are that you will meet and exceed the responsibilities shown where possible in an appropriate and safe manner and have a great time doing it too! CIO Head of IT Services Information Security Manager What is the purpose of the job? The Information Security Manager will be responsible for the development, maintenance and auditing of IT Security controls and processes for Cyber Security and PCI DSS compliance. The role will require strong project and security skills in the delivery and management of the overall Cyber Security and PCI programme whilst being able to translate security policy statements into practical IT security solutions. What are the essentials of the job? Compliance PCI DSS To lead and manage the programme within Virgin Trains to gain PCI DSS compliance. To work with the QSA, IT Project Managers and Technical Architects in the delivery of the PCI DSS compliance. Tracking and management of PCI DSS v3.0 requirements and relevant controls. To manage technical teams, 3 rd parties and suppliers on the technical delivery of the PCI DSS controls. To create all policy documentation, processes and verifications required for PCI DSS compliance. Able to assist in the creation of an RFI, RFP and ITT as required for any security solutions. Provide security QA all relevant design documents coming in from partners and third parties. Be able to identify security solutions to meet the relevant PCI DSS requirements. Cyber/IT Security To act as security lead to the Business and Project Managers on any relevant security matter or project. Define the IT Security Strategy encompassing Cyber Security and PCI DSS compliance. Manages all technical parties, internal and external, in the delivery of security solutions. Assists in enforcement of security policies, processes and compliance. Ensures that all technical solutions are in line with the IT Security Strategy. Communicates and applies security standards as required. Identifying and reporting any potential security risks on all projects within Virgin Trains. Manage IT Security risks on behalf of the IT Department and raise this as appropriate to the Senior Management Team. Ensures security risks are identified, tracked, reported on and resolved in a timely manner. Responsible for managing and seeing through Audit compliance actions from security/cyber audits.

2 Job essentials continued Project Management Assists in enforcement of project deadlines and schedules. Understands the components of running a fiscally successful project. Able to create technical implementation plans, test plans and assist in service architecture. Tracking and management of technical requirements throughout the engagement life cycle Fundamentals Communication Assists in the facilitation of team and business meetings. Delivers informative, well-organised presentations. Understands how to communicate difficult/sensitive information tactfully. Technical Understanding Possesses strong understanding of security, compliance and risk management, processes and principles. Possesses strong understanding in a broad range of security architectures and components. Must have a minimum of 3-5 years experience of information security experience. Must have experience of successfully delivering PCI DSS compliance. Should have experience of Cyber Security and general security controls and principles. Should have experience of be able to managing IT security risks. Capable of managing business change as required. Have customer centric approach to security delivery Delivering Service Identifies security and compliance issues with ease. Able to describe and express security risks in business terms Proactive approach to investigating and resolving live security issues.

3 Job essentials continued Professional qualities Leadership Technology leader capable of driving the business forward. Must be able to technically lead internal and external technical resources in the delivery of proposed solutions. Proactively seeks opportunities to serve in leadership roles. Demonstrates role model behaviour across the business. Manages the process of innovative change. Teamwork Strong team working ethic with the IT Team and across the business. Facilitates effective group and team interactions. Acknowledges and appreciates each team member's contributions. Customer Partnering Develops relationships within the business and externally that fosters trust and builds successful partnerships. Communicates effectively with the business to identify needs and evaluate alternative technical solutions with project management. Continually seeks opportunities to increase customer satisfaction and deepen customer relationships. Manages business expectations effectively. Organisational responsibilities Innovator Development Mentors those with less experience through informal channels. Seeks and participates in development opportunities above and beyond training required by us. Trains colleagues through both formal and informal training programs. Internal Operations Suggests areas for improvement in internal processes along with possible solutions.

4 How do I stay safe in the job? Virgin Trains subscribes to the six key Railway Industry Safety Rules. Commitment (Safety is the first consideration in everything we do, if it isn't safe, we don't do it) Leadership (Safety begins at the top - we walk the talk and set a visible example) Openness (Safety is openness - information is shared and investigation conclusions are open to all parties) Reporting (Safety is knowledge - we report every incident and take immediate remedial action) Responsibility (Safety is everyone's responsibility - we learn from mistakes and will not tolerate negligence) Measurement (Safety needs a common measure - we shall use lost time, accidents and other appropriate measures) Virgin Trains Specific Safety Responsibilities: Not Applicable

5 Why is the Virgin name so important to my job? This post holder will be expected to behave in a manner equal to the position. This post requires flexibility of hours, location, energy application and vision as required by the project. This post holder may be required to stay away from home on occasion. This post holder will respect the very strict code of confidentiality operated within the team. Any breach of confidentiality, pursuit of agenda's other than those associated with its project or expression of opinions not related directly with this role will be dealt with seriously. Virgin Trains behaviours are to be focused on our Customers, to listen actively, to work as a team, to empower others and to show empathy. Our ultimate goal is to create an amazing experience for customers every time they travel with us. Virgin Trains Brand Values are that we will be: Daringly Bold Being courageous and brave being out of your comfort zone. Doing the right thing Moral, fair and just. Acting with empathy, putting yourself in the customers shoes. Insatiable Curiosity Asking questions, listening, acting on it. Red Hot Showing the best of your personality. Passion, enthusiasm and sparkle!! With Heart Really caring about what you do and showing it. Emotional welfare being genuine. Delightfully Surprising Doing the unexpected to create amazing. Delegated Authority Not Applicable

6 Key Contacts All employees, managers and Directors involved in ensuring successful management of compliance and risk. Suppliers and Partners Experience, Skills and Knowledge Possesses strong understanding of security, compliance and risk management, processes and principles. Possesses strong understanding in a broad range of security architectures and components. Must have a minimum of 3-5 years experience of information security experience. Must have experience of successfully delivering PCI DSS compliance. Should have experience of Cyber Security and general security controls and principles. Should have experience of be able to managing IT security risks. Capable of managing business change as required. Have customer centric approach to security delivery Qualifications & Training Educated to Degree level or relevant experience The following certifications; CISSP, CISM, CEH

7 What do I need to do my job? All documentation and equipment issued to you (including uniform and travel documents) remains the property of Virgin Trains. It is your responsibility to ensure that all property is returned upon termination (for whatever reason) of your employment with Virgin Trains. Sign on the dotted line... Authorised by: Date. Post Holder: Date.