Principal Information Security Officer

You will report to the Director of Cyber Security and will be working to deliver the Architecture and consultancy, Identity and Access Management and Governance, Risk and Compliance activities within the Westcoast Security Model.

The role will involve working in partnership across the group with both stakeholders, technical teams, development functions and third parties to deliver Secure Development Lifecycle (SDLC) processes and solutions, compliance and consultancy activities. These activities will need to comply with standards such as ISO27002, Cyber Essential Plus, PCI-DSS, DPA:2018. EU Directives and PASF as well as customer specific requirements while also aligning with ISO22301 and resiliency requirements. As an experienced practitioner you will be looking to improve maturity and standards, setting goals and plans with meaningful metrics and KPIs.

As well as working within the PMO on projects you will work the Heads of, through the group compliance board on maintaining external standards, as well as deputizing for the Director of Cyber Security in their absence. As an experienced security lead, you will lead on the security engagements, providing subject matter expertise on requirements, compliance, contracts, controls, resilience, testing and assurance.

Regular travel to UK based offices is required in this role. You must be able to achieve Westcoast security vetting.

Your Day-to-Day Responsibilities Will Include:

• Maintaining a security assurance program in support of PMO portfolio
• Developing initiatives on inter group Security Improvements
• Working with the Technical Design Board on developing security architecture and patterns.
• Driving improvement in the SDLC processes
• Maintaining compliance with external security standards and frameworks required by regulators and customers and working in partnership with Compliance, Legal, and Internal Audit functions
• Security assessment and management of Westcoast hosted and cloud infrastructure, networks, endpoints, and applications and data against threat models. Including developing testing and remediation plans with tracking.
• Working with system owners to drive the implementation of identity good practice and in particular single sign on and federated services
• Security Reporting providing management reporting and real time dashboards, to provide the security team business and management assurance of the compliance of projects and IT security controls
• Work with Security Operations and Engineering teams on control effectiveness
• Where requested on contracts - Provide end to end assurance of compliance with existing Information Security policies and standards (attend meetings with customers etc.).

We are looking for someone who can shape change and has an experience in GRC, security architecture, consultancy and identity management. Our ideal candidate will have a focus on improvement, a passion security and strong technical skills.

To be successful in this role you will have some of the following skills and experience and the desire to develop in other areas:

• Minimum of 5 years’ experience in a relevant security position
• A security professional qualification such as CISSP, CISM, CCSP, CISA, ISO27001 Lead Implementor/Auditor, CEH or equivalent
• Or an equivalent recognized Information Security discipline Degree: NCSC-certified degrees - NCSC.GOV.UK
• Previous experience and knowledge of security frameworks i.e. ISO27001, NIST, CIS Controls and PCI-DSS compliance
• An understanding of HMG security standards (e.g. Security Policy Framework, Cyber Essentials Plus, Cloud security principles etc.).
• Experience of Enterprise Project Management practices as related to information Security
• Experience of working with enterprise level IT and network teams, systems and processes
• Experience of working with MSSPs, Pentesters, Redteaming, external SOCs
• Experience of security products, e.g., firewalls, web filtering, anti-virus etc.

• Generous Benefits Package: A salary of up to £70,000 depending on experience. Enjoy 25 days of holiday, employee referral bonuses, perks and discounts. (Theale only - New fully equipped gym available 24/7).
• Wellbeing Support: Access to Westcoast Wellbeing services including mental health counselling, virtual GP services, physiotherapy, life insurance, eye care schemes, and more.
• Community & Connection: Our teams enjoy social and charitable events throughout the year, fostering a strong sense of belonging.

Westcoast Ltd established in 1984, the Westcoast Group remains privately held with its distributor arm, Westcoast Limited, distributing leading IT brands such as HP, HPE, Microsoft, Lenovo, Apple, and many others to a broad range of resellers, retailers and office product dealers in the UK and beyond.

Westcoast Limited has grown to become the number one UK distributor for many of our vendors and customers. The Westcoast Group employs more than 1,600 people across a number of locations in the UK, Ireland and Europe. Our revenues have seen a sharp increase in recent years reaching £3.5 billion in 2020.

We are consistently ranked in the Sunday Times Top Track of the 100 Largest Privately-owned UK Companies, and are now the largest privately-held business in the Thames Valley region

At Westcoast, we take pride in distributing some of the most renowned global IT brands to resellers, retailers, and organizations across the UK and beyond. As an innovative and inclusive company, we thrive on teamwork and the diverse talents of our people. We invite you to turn your passion into a rewarding career with us!