ICT Cyber Security Manager (Band 8A)

Detailed job description and main responsibilities

Key duties and responsibilities include

Lead the day-to-day management and continual improvement of the Trust’s cyber security capability, including processes, technologies, controls, procedures and associated documentation. Develop, implement and maintain cyber security policies, standards, procedures and guidance that support the Trust’s strategic objectives, statutory obligations and national NHS requirements. Provide expert cyber security advice to senior managers, Digital colleagues, programme teams, clinical services and corporate functions on risk, assurance, control design and secure implementation of new and existing technologies, including cloud services and hybrid environments. Lead the identification, assessment, prioritisation and treatment of cyber security risks, ensuring risks are clearly articulated, documented, escalated and monitored through appropriate governance routes. Provide assurance, reporting and expert advice to senior governance groups and designated leads on cyber security risk, incidents, control effectiveness and compliance activity. Oversee vulnerability management processes, including scanning, assessment, remediation planning, exception handling and reporting, working with infrastructure, applications and third-party suppliers to reduce cyber risk. Lead the Trust’s response to cyber security incidents and events, coordinating investigation, containment, eradication, recovery, lessons learned and follow-up actions, and participate in the Trust’s on-call rota to provide out-of-hours support for cyber security incidents, major incidents and urgent service issues as required. Ensure appropriate monitoring, alerting, triage and escalation arrangements are in place for cyber security events, and that security tools such as SIEM, endpoint protection, email security and privileged access controls are configured and used effectively to support detection, response and assurance. Lead on cyber assurance activity, including preparing evidence, coordinating responses and supporting the completion of the Data Security and Protection Toolkit, Cyber Assessment Framework requirements, audits and external reviews including penetration testing. Support the development and testing of cyber resilience, business continuity and disaster recovery arrangements, including leading tabletop exercises, incident simulations and post-incident reviews. Work with infrastructure, applications, suppliers and service owners to support high availability, service uptime and operational resilience across critical digital services, and develop reporting on availability, outages, recovery and related performance metrics to inform assurance and improvement activity. Embed secure by design principles into digital projects, procurements, architecture decisions and service changes, ensuring cyber security is considered early and proportionately across the lifecycle, including for cloud services, hosted platforms and hybrid infrastructure. Lead cyber security review and assurance for significant technical change, service design, procurements and third-party solutions, ensuring appropriate due diligence, risk assessment and security requirements are applied. Support the completion and review of cyber security questionnaires, Data Protection Impact Assessments (DPIAs) and related assurance documentation for new systems, services, suppliers and change activity, working closely with Information Governance, procurement and service leads. Work closely with Information Governance, data protection, clinical safety, infrastructure, applications and supplier management colleagues to ensure a coordinated and effective approach to cyber and information risk. Produce high-quality reports, dashboards and briefings on cyber risk, incidents, vulnerabilities, assurance and performance for senior management and governance forums. Manage and develop staff within the cyber security function where applicable, including supervision, objective setting, performance management, coaching and supporting professional development. Contribute to the development of cyber business cases, service improvement plans, investment proposals and technical specifications, ensuring value for money and alignment to organisational priorities. Play a key role in the development, implementation and ongoing review of the Trust’s cyber security strategy and roadmap, ensuring priorities are aligned to organisational risk, digital transformation plans, regulatory requirements, available resources, and relevant national and regional cyber security strategies, frameworks and assurance expectations. Build and maintain effective working relationships with NHS England, partner organisations, auditors, suppliers and specialist third parties as required to support the Trust’s cyber resilience and compliance position, including supplier assurance and supply-chain cyber risk management. Lead and support cyber awareness and education activity across the Trust, helping to strengthen security culture and improve staff understanding of threats, responsibilities and good practice. Keep abreast of emerging cyber threats, vulnerabilities, standards, legislation and NHS guidance, translating these into practical advice and proportionate action for the Trust. This job description may be subject to change according to the varying needs of the service. Such changes will be made after discussion between the post holder and the manager. All duties must be carried out under supervision or within Trust policy and procedure.