Security Specialist

Home » Vacancies » JOB-15329

Security Specialist Job type: Permanent Salary: £46,511 per annum Location: Scunthorpe, North Lincolnshire Apply now

About this role

Job Title: Security Specialist

This is a job working for Ongo

Salary £46,511

Job Summary

To be responsible for the groups strategic and operational security and compliance activities.  Building a picture of existing ICT usage and providing recommendations on future technology, architecture and process changes to improve security and compliance, including a strong involvement in subsequently implementing these changes.

Main Responsibilities

• Analyse and audit systems for security threats using internal and external audit resources.
• Manage and implement remediation action plans, ensuring recommendations are prioritised in order to improve the groups Cyber security controls and posture.
• Monitor the external threat environment and relevant Cyber security intelligence sources, informing the group of emerging threats, their impact and appropriate course of action.
• Define, manage and measure IT Security and risk-related KPI’s to support understanding of the risk.
• Ensure technical writing is completed on all changes and projects to enable internal and external support to effectively troubleshoot and maintain.
• Documentation of all areas of infrastructure processes and procedures at both summary and technical levels.
• To implement system changes in line with the department’s change management procedure.
• Maintain excellent working relationship with customers, 3rd party support, developers and other key professionals.
• Promote the importance of IT security throughout the group and help staff maintain an awareness.
• Ensuring best practices and industry standards are being adhered to as far as possible ensuring we remain secure & compliant.
• Provide input in order to help maintain the organisations cyber risk framework.
• Work with third parties to mitigate risk of systems and or data accessed or processed by those third parties. Providing assurance that 3rd parties are working in line with our standards.
• Assist the team with security, design and architecture decisions.
• Respond to cybersecurity incidents.
• Carry out non-technical and technical auditing and compliance checks and applicable attestation such as PCI-DSS, Cyber Essentials Plus, and company and industry security standards.
• Lead in developing, testing and invoking disaster recovery plans.
• Monitoring, response and patching of infrastructure vulnerabilities including vulnerability management
• Competent in the use of a wide range of ICT products, and be able to use own initiative, to provide a problem resolution service to the company.
• Work with an outline of requirements to design, plan and implement imaginative and appropriate solutions to industry approved security standards and best practices.
• Analyse and evaluate new products that will bring benefits and improvement to the group, making innovative recommendations to the Technology & Innovation team.
• There is a requirement for contact with all stakeholders across the organisation providing consistent assistance and advice on the use of ICT.
• Daily contact with ICT team where complex systems issues are discussed and resolved or escalated.
• Technical correspondence with Solution Specialists with regard to changes and upgrades of company applications and infrastructure.
• Work within the set targets and procedures determined by T&I Management.
• Able to make proposals for improvement and bring them forward to the T&I Management Team.

• Ability to formulate solutions and ideas for development using own initiative.
• Responsible for planning workload to comply with set deadlines & Business needs.

• Trusted with significant administration level privileges, working on business systems and platforms where misconfiguration could result in a significant impact to the integrity of Ongo’s ICT infrastructure and cyber-security posture.

• Responsibility for sensitive data within the applications & platforms that they manage.
• Building key holder for response to out-of-hour incidents.
• Responds to escalations arising from detections from the MDR solution.

• Requests for impromptu advice and demonstrations of ICT knowledge.
• Re-prioritisation of work due to changes in business needs, policy & urgent tasks on a daily basis, working to strict deadlines at all times set by the organisation.
• Unforeseen technical problems that require immediate attention such as system failures requiring work to be carried outside office hours and on own initiative when the situation.
• Authorising for payment of significant project-related spend, ensuring that this is in-line with purchase orders authorised and delivering the agreed services.
• Regular requirements to work outside of normal hours to minimise planned downtime and risks of unforeseen downtime, working on a time off in lieu basis.

 Skills, Competence, Experience Required

• Excellent understanding of OSI model and networking.
• Experience of legislative frameworks and industry standards e.g. PCI-DSS, ISO27005, ISO27001, NIST, CAF, NCSC, CISM, Cyber Essentials Plus and GDPR.
• Information Security certification in a specialist field desirable (CISSP, CISM or equivalent).
• Proactive pen testing of systems at set or ad hoc periods using industry standard tools. Subsequent reporting, prioritization, and remediation of any findings from these tests.
• Excellent understanding of monitoring solutions and associated best practices, such as environmental monitoring, infrastructure monitoring, SNMP.
• Previous experience working in a dedicated Information Security role desirable.
• An understanding of security testing methodologies, penetration testing, red team, blue team, and associated testing requirements from industry standards, and the ability to identify  solutions.
• Excellent understanding and diagnosis of authentication technologies, such as 802.1X.
• Be competent with and have an understanding of networking theory and practicalities.
• Thorough understanding of system security including security platforms, endpoint protection platforms,  and next generation firewalls. MDR, XDR, IPS.
• Experience working with virtualisation technologies, in particular VMware and Azure.
• Experience in IaaS, PaaS and SaaS platforms.
• Configuration and planning of security related actions within Microsoft Entra and Microsoft InTune. I.e. Conditional access, MFA, RBAC.
• Specialist expert knowledge & practical experience of managing Windows 11, Windows Server 2016/2019/2022 and Linux servers, for hardware, software and associated applications.
• Knowledge and experience of a SAN environment and infrastructure.
• Knowledge of network security configuration for vendors such Cisco, Meraki and Ubiquiti.
• Experience in auditing and administering SQL instances, including high availability clusters. Ensuring availability