IT Security & Risk Manager

Jewish Care is dedicated to leveraging digital technology to improve efficiency, service quality, and compliance. As part of our Digital Transformation programme, we aim to enhance our ways of working and better support the people we serve.

To achieve this vision, we are seeking an experienced IT Security & Risk Manager to safeguard our IT infrastructure, ensuring it is secure, resilient, and capable of meeting our current and future strategic goals.

As IT Security & Risk Manager, you will be pivotal in shaping Jewish Care’s IT security posture. You will oversee the implementation of security frameworks, identify risks, and recommend mitigation strategies. This role requires a proactive leader who can balance technical expertise with a pragmatic approach to risk management.

This post is full time working an average of 36.25 hours per week on a hybrid contract with 2 days in the office per week.

Responsibilities

1. Security Framework Development: Create, implement, and monitor Jewish Care’s IT security posture, ensuring compliance with standards like Cyber Essentials+ and NIST CSF.
2. Policy and Compliance: Own and maintain IT security policies, ensuring adherence across the organisation.
3. Risk Assessment and Mitigation: Identify infrastructure risks and provide actionable recommendations.
4. Incident Response: Plan and coordinate IT security updates and responses to potential threats.
5. Strategic Advice: Advise the Information Security Committee on suitable security controls and deviations from base configurations.
6. Reporting: Prepare detailed reports for Trustees and the Internal Audit & Risk Committee.
7. Procurement Support: Assess compliance and risks associated with system and software procurement.
8. Training and Awareness: Lead cybersecurity training initiatives to build organisational awareness and resilience.

What We’re Looking For

1. Formal qualifications in Networking and Security (CISMP, CISSP, ISO27001).
2. Proven experience leading an organisation through cybersecurity improvements, including technical tools and training.
3. Track record of maintaining industry accreditation such as Cyber Essentials+.
4. Strong knowledge of IT Security frameworks (e.g., NIST or ISO27001).
5. Hands-on experience with IT systems like Meraki Networking, Sophos, Mimecast, Azure VPN, and MS Intune.
6. Pragmatic approach to IT security and risk management.
7. Exceptional communication skills, with the ability to influence stakeholders at all levels.
8. Strategic thinker who can plan and execute long-term initiatives.
9. Strong project management skills, capable of handling multiple priorities.