Purpose of the role:

Lead the enterprise-wide information security and cybersecurity management programme for our client's technology environments. The role is accountable for cybersecurity governance, ISO 27001 continual improvement, data protection, risk and compliance, security operations and alignment with the Client-approved Cyber Security Management Plan, while strengthening resilience against evolving cyber threats and data breaches.

Key roles & responsibilities:

·   Define, implement and continually improve the cybersecurity, information security, data protection and governance, risk and compliance framework across IT and Rail operational technology environments.

·   Own the information security management system and oversee ISO 27001 certification, maintenance, audit readiness and compliance with applicable data protection requirements.

·   Serve as Data Protection Officer and primary cybersecurity liaison with internal teams, the Client, auditors, regulators, suppliers and external partners.

·   Lead the execution, monitoring and reporting of Cyber Security Management Plan initiatives, identify gaps and implement corrective actions in line with regulatory and contractual requirements.

·   Direct 24/7 security operations covering threat monitoring, detection, incident response, vulnerability assessments, penetration testing, forensic audits and maintenance-related cybersecurity activities.

·   Oversee Rail operational technology threat detection using Nozomi Networks IDS and ELK Stack-based SIEM capabilities and ensure effective integration between IT and operational technology security.

·   Manage cybersecurity projects, risk assessments, technology proof-of-concepts, budgets, resources and security awareness programmes.

·   Lead, mentor and develop the cybersecurity team and promote a strong culture of security, privacy and compliance.

Key skills and experience:

·   Bachelor’s degree in computer science, information systems or an equivalent discipline, together with a recognised cybersecurity certification; a relevant master’s degree is desirable.

·   Over 10 years of relevant experience, particularly in Rail operational technology systems design and maintenance, information security, cybersecurity and data protection.

·   Experience managing cross-functional cybersecurity teams and operating across both IT and operational technology environments.

·   In-depth knowledge of cybersecurity frameworks, system assurance, risk management, incident response, privacy regulations and ISO 27001:2022.

·   Experience with Rail operational technology security controls and monitoring tools

·   Strong understanding of data protection legislation, with proven ability to assess and manage privacy and cybersecurity risks; Data Protection Officer experience is desirable.

·   Excellent analytical, leadership, communication and stakeholder management skills, with the ability to respond effectively in time-sensitive and emergency situations.

·   Advanced certifications such as CISM, CRISC, CGEIT or CISSP and knowledge of NIST CSF or IEC 62443 are desirable.