Pearson IT Security Manager in Rotherham, United Kingdom
IT Security Manager
At Pearson, we’re committed to a world that’s always learning and to our talented team who makes it all possible. From bringing lectures vividly to life to turning textbooks into laptop lessons, we are always re-examining the way people learn best, whether it’s one child in our own backyard or an education community across the globe.We are bold thinkers and standout innovators who motivate each other to explore new frontiers in an environment that supports and inspires us to always be better. By pushing the boundaries of technology — and each other to surpass these boundaries — we create seeds of learning that become the catalyst for the world’s innovations, personal and global, large and small.
Through the NCT programme, Pearson delivers assessment services for National CurriculumTests at Key Stage 2, tests used to help measure progress at the end of primary school acrossEngland. The NCT programme manages the delivery of these services under contract with theStandards and Testing Agency. The services encompass the registration of pupils for the tests,the design and production of marker training materials, training of 4.5k markers, the marking ofapproximately 4 million completed tests and the delivery of test results to 16.5k schools acrossthe UK, securely as well as to time and quality.
An extensive programme of ‘back office’ activities support the delivery, ranging from ITinfrastructure and software services, print, logistics services, marker recruitment services,training, through to programme management, risk management, Helpdesk services and securitymanagement.
Pearson has to ensure its delivery of the NCT programme is compliant with both contractual andindustry-best practice security requirements.
Pearson’s Chief Information Security Office(CISO), part of the Pearson Technology services, shapes security provision across Pearson,providing and leading on expertise in security architecture & engineering, forensic investigation,governance risk & compliance (GRC) as well as defining and maintaining corporate level policiesand standards. Protection of the data involved in the services is of paramount importance toPearson, requiring pro-active management of security practices and controls throughout theprovision of NCT services.
Support the NCT Head of Security with all IT Security aspects of information governance and security management relating to Pearson and its NCT sub-contractors.
Be a champion of Global Security Policies and Standards, including the NCT security policy across the Pearson IT Services, ensuring compliance with the relevant version of the Cabinet Office Security Policy Framework and the principles of ISO 27001.
Monitor and report on compliance with the security policies in the delivery of the Service, including within the NCT programme and across the Pearson organisation.
Provide support to the Pearson IT organisation in relation to security requirements as defined in the NCT contract, meeting internal service levels including timely resolution of customer queries with a high standard of customer communication and support.
Lead, conduct and document investigations relating to IT security and IT DR BCP incidents ensuring compliance with ITIL, ISO 27001 and ISO 22301 as appropriate to the incident.
Support the NCT Head of Security with the reporting of security incidents to stakeholders.
Be a champion of the IT DR solution with regard to NCT Business Continuity Plan, leading on the production of comprehensive NCT documentation through the execution of the Pearson defined business continuity process for DR, including running business impact analysis across the Technology organisation programme, supporting the NCT programme in instances of business disruption and production of reports on status of business Technology recovery.
Preparation of management information and report production relating to the IT security status of the NCT programme.
Undertake key Pearson tasks within the Government security accreditation process (known as DSAM) that NCT is subject to, including:
Planning and commissioning of ITHC/pentests, and management of outputs from the tests in collaboration with the IT Project Manager as to the remediation of the findings.
Planning and coordinating appropriate levels of internal security testing across the NCT environments, including web application and infrastructure vulnerability assessments, ensuring that open vulnerabilities are remediated in accordance with internal policies and contractual obligations.
Dissemination across Pearson teams of requests for information regarding the NCT system, management of those requests through to receipt of information, and onward clear communication of the information into the accreditation process.
Representation of Pearson with a variety of interfaces within the accreditation process, including STA, DfE, and specialist expertise providers (eg a CESG, CCP).
Identification, escalation, mitigation and review of risks, issues and opportunities for continual improvement relating to these IT security activities and related programme activities.
Monitor and ensure the implementation of security processes of subcontractors involved in the NCT programme, ensuring their service delivery complies with HMG’s SPF.
Experience of implementation of security management within the bounds of compliancewith HMG’s Security Policy Framework, ISO 27001, RMADS, and ISO 22301.
Experience of investigation techniques and report writing.
Experience of risk management methods and logging of risks.
Experience of process mapping and delivery of effective and understandable process maps and associated procedures.
Ability to interact with senior management stakeholders, with excellent verbal and written communication skills, build strong relationships at all levels and across all business units and organisations, and understand business imperatives.
Adherence to high quality written communications, required by the client and expected across Pearson and the NCT programme.
Understanding of extensive and wide-ranging security requirements defined in in-depth contractual documents.
Distillation of the security requirements into practical, proportionate and understandable instructions and guidance across the programme.
Working within a regulated framework and PRINCE2 contractual delivery requirements.
Security certification such as CISMP (Certified in Information Security Management Principles), Certified Information Systems Security Professional (CISSP), Certified Information Systems Manager (CISM), ISSMP (Information Systems Security Management Professional).
ISO 27001 Lead Auditor and/or Lead Implementor
Prince 2 Foundation level or above.
A bachelor degree in information systems or equivalent work experience.
CCP (CESG) Certified
Familiarity with applicable legal and regulatory requirements, including, but not limited to, the U.S. Sarbanes-Oxley Act, the U.S. Health Insurance Portability and Accountability Act (HIPAA), the European General Data Privacy Regulation (GDPR), and PCI/DSS.
Knowledge of a broad range of security technologies, including NextGen Firewalls, DLP, NAC, IDS/ IPS, IdAM, PKI, SIEM, Anti-malware, vulnerability management.
Hands-on experience scoping and managing vulnerability assessment and penetration test.
Working knowledge of Industry Standard Product and Program Development Life Cycle, including Secure SDLC and the principles of Agile software development.
Primary Location: GB-GB-Rotherham
Work Locations: GB-Rotherham-Hellaby Lowton Hellaby Bus Park, Lowton House Lowton Way Rotherham S66 8SS
Organization: Technology & Operations
Employee Status: Regular Employee
Job Type: Standard
Shift: Day Job
Job Posting: Apr 12, 2017