The Head of Information Security is responsible for leading and continuously developing Kingsley Napley's cyber security capability ensuring the confidentiality, integrity and availability of the firm's information systems, data and services.

Reporting to the CIO, the post holder will be accountable for the delivery of the firm's cyber security strategy, security operations, incident response, security assurance, supplier security and cyber risk management, ensuring activity is clearly prioritised against business risk, client expectations and the firm's strategic objectives.

The role will maintain ownership of the firm's ISO27001 Information Security Management System, Cyber Essentials Plus certification and wider security policies and standards.

The post holder will work closely with the Chief Legal Officer through a dotted-line reporting relationship, supporting the firm's wider governance, regulatory and client assurance obligations, DPO-related activities, client tenders and regulatory compliance matters.

The role will work in close partnership with the Head of IT Operations, Head of Data and key business stakeholders to ensure security is embedded across technology, data, operational and business initiatives.

Success in the role will be measured by demonstrable improvements in cyber maturity, effective operation of the SOC, timely remediation of material security risks, successful maintenance of key certifications, clear senior leadership reporting and the consistent embedding of security controls into technology and business change.

Cyber Security Leadership

• Develop and deliver the firm's cyber security strategy in line with the firm’s goals and risk appetite.
• Lead and continuously improve the firm's cyber security capability, roadmap and maturity.
• Act as the firm's senior cyber security subject matter expert.
• Provide security leadership across technology including data, cloud, infrastructure and business projects and initiatives undertaken.
• Promote a positive cyber security culture across the firm.
• Define clear security objectives, success measures and reporting that demonstrate progress against the firm's cyber risk profile and strategic priorities.

Security Operations

• Own and manage the firm's security operations capability.
• Manage and continuously improve the firm's outsourced Security Operations Centre (SOC).
• Oversee security monitoring, threat detection and incident management processes.
• Lead the investigation and response to cyber security incidents.
• Oversee vulnerability management, remediation planning and security improvement activities.
• Coordinate annual penetration testing exercises and remediation programmes.

Security Assurance & Architecture

• Provide security oversight and assurance across infrastructure, cloud platforms, SaaS solutions and business applications.
• Set and maintain security architecture principles and standards that guide technology change across infrastructure, cloud platforms, SaaS solutions, data and business applications.
• Ensure security and privacy-by-design principles are incorporated into technology change initiatives.
• Provide security approval, challenge and assurance at appropriate project governance stages, including early design review, procurement, implementation and go-live readiness.
• Escalate material security risks, exceptions and risk acceptance decisions where proposed solutions do not meet agreed standards or fall outside the firm's risk appetite.
• Work closely with the Head of IT Operations to align operational and security priorities.

Governance, Risk & Compliance

• Maintain responsibility for ISO27001 certification and continuous improvement activities.
• Maintain Cyber Essentials Plus certification.
• Manage security policies, standards and procedures.
• Conduct ongoing security risk assessments and track remediation activities.
• Provide regular reporting to senior leadership.
• Support the CLO and General Counsel on governance, regulatory and compliance matters as required.
• Provide clear, risk-based reporting to the CIO, and senior leadership, including key risks, control effectiveness, remediation progress and areas requiring decision or escalation.

Business Continuity & Resilience

• Support the Chief Legal Officer in maintaining and developing the firm's ISO22301 Business Continuity Management System.
• Coordinate testing and exercising of business continuity and disaster recovery arrangements.
• Support the firm's operational resilience objectives.

Supplier & Client Security

• Own the firm's third-party security assurance programme.
• Assess supplier security controls and support technology procurement activities.
• Support client security audits, due diligence requests and tender responses.
• Provide security input into significant client opportunities and strategic initiatives.

Data Security & AI

• Work closely with the Head of Data, Director of Innovation and CLO/DPO to ensure appropriate security controls are applied to the firm's data, reporting, analytics and AI initiatives.
• Provide security and risk advice relating to AI solutions, data protection and emerging technologies.
• Support the secure adoption of data and AI services across the firm.

Leadership & Team Management

• Lead, develop and mentor members of the Information Security team.
• Manage external security suppliers and partners.
• Establish a culture of accountability, continuous improvement and professional development.
• Support the ongoing development of cyber security awareness and capability across Technology Services.