Unilever - Information Security Innovation Manager

Business Context and Main Purpose of the Job

- The Information Security Innovation Manager is primarily responsible for the engagement with IT innovation and architecture teams to ensure that Information Protection requirements are clearly understood, operating effectively and adequately managed for all new capabilities.

- The Innovation Manager must have an excellent understanding of both business requirements and all aspects of the Information Protection framework. Key to the role is senior stakeholder management within IT Innovation - acting as a single point of contact for IT capability owners.

- The innovation manager will manage a team of Information Security Innovation analysts and will also play a hands on role in ensuring control objectives are met

Main Accountabilities:

- To lead & manage a team of Information and IT Security SME's and to ensure that all Information Protection requirements are implemented in innovation activities and security related projects.

Governance And Engagement:

- Primary engagement for Information Security to a group of key senior stakeholders and to ensure that all Information Protection requirements are met in their key innovation initiatives.

- Manage senior stakeholder expectations with regard to Information Protection processes.

- Responsibility for all Information Protection aspects for several IT portfolios.

- Responsibility for the operation of Information Protection requirements in the IT innovation process, Business / IT engagement, Information Security standards, Security testing and key supplier management.

- Provision of all required reporting aspects to measure process compliance and provide assurance to senior stakeholders.

- Support the Director Information Security and work in partnership with the IT Leadership teams to develop and drive Security enabled IT delivery plans for the future.

- Collaborate with IT Security Operations, Information Security, Data Privacy and CTO teams to ensure alignment of plans and future requirements.

Innovation - Secure By Design:

- Define and operate the Secure by Design process to ensure that all new initiatives are appropriately identified and implemented with required Information Protection controls as part of a standard Software Development Life Cycle (SDLC).

- Analyse and report all Information Protection aspects for appropriate steering groups for relevant programmes and or key projects.

- Manage any non-compliance to Information Protection requirements and ensure that the impacts and risks are managed and understood by key stakeholders.

- Responsibility for the definition and implementation of any identified tooling required to operate the Secure by Design process.

- Measure and report Information Protection process & control compliance across the entire innovation portfolio.

Information Security Standards:

- Understand the corporate requirements related to security, legal and regulatory compliance, and ensure these are defined within current internal policies and standards.

- Work with Data Privacy and Legal teams to ensure Data protection and other regulation is embedded in security processes, standards and policies.

- Manage the process for the development, ratification and publishing of new security standards and control requirements across both the internal and external enterprise.

- Manage any non-compliance to control requirements through ongoing assessment and risk management processes.

Security Testing:

- Ensure that the right level of penetration testing happens for new projects and existing systems & infrastructure. Including assessment and management of results.

- Monitor and control scope and costs of penetration testing.

- Monitor and report key incidents and their corroboration with penetration testing and vulnerability management.

Team Management & Development:

- Responsible for managing a team of Information Security Subject Matter Experts, consisting of permanent and contractor resource.

- Responsible for the professional development of permanent team members.

Advisory:

- Offer internal consultancy advice and practical assistance on all matters relating to Information Security.

Essential:

- Team management, recruitment and development

- Minimum 5 years in an Information / IT Security management role.

- Minimum 5 years working at a middle management level in a large complex business environment requiring balanced risk decisions, technology decisions, and management of stakeholder pressures.

- Design, implementation and operation of all Information / IT Security processes.

- Working in roles requiring high level of technical standards, and operating within legislative and regulatory frameworks

- Implementing and managing Information Security assessments delivering positive outcomes and high trust to leadership.

- Achieving outcomes and results by influencing the way resources not in your control are utilised as well as in managing them directly

Key Skills:

- Professional qualification in information security - e.g. CISM CISSP or equivalent.

- Degree level education.

- Proven capability in the design, implementation and operation of Information Security control frameworks (e.g. ISO27000).

- Expert level understanding of all people, process, technical Information Security control requirements.

- Sound, broad knowledge of IT and business context.

- Understanding and knowledge of regulatory aspects of information security including data protection and SOX.

- Experience within a consumer goods or retail environment preferable.

- Excellent communication and senior stakeholder management.