Information Assurance and Security Officer - Legal Aid Agency (Ref: 23071)

Job Title & Grade: Information Assurance and Security Officer - HEO

Contract Type: Permanent

Salary range (depending on location): National - 35,335 to 37,847 London - 40,014 to 42,859

Please note that unless you are currently employed by the Civil Service and are earning more than the minimum above, if successful you will be offered the minimum for the grade depending on your location.

Location: Any LAA office

Please note that whilst this role is advertised externally, you can only apply for London, Cambridge and Brighton offices if you are a current LAA staff member based in those offices. This is due to and in line with the LAA's Location Strategy and the Cabinet Office's Places for Growth Strategy.

Minimum Working Pattern:

This role can be offered on a full-time or part-time basis. If you are applying for a part-time role, please note that to meet business demands we need cover for a minimum of 28 hours.

To meet legal requirements, if you are between the ages 16-18 and you are a successful candidate, you will be required to complete an apprenticeship after your initial on the job training.

The Legal Aid Agency

We are an executive agency of the Ministry of Justice (MoJ). We areresponsible for operationally administering the legal aid fund to provide criminal and civil legal aid advice to people in England and Wales.

Our people are at the heart of achieving excellence. Employing around 1,200 colleagues across England and Wales, we feel proud to have some of the best People Survey results in the Civil Service.

Corporate Services & Assurance

The Corporate Services directorate works across the LAA to help shape and enable the priorities of the Chief Executive and Executive Leadership Team, providing support on areas such as strategy, data analysis, risk, assurance, counter-fraud, communications, people and capability to all other parts of the LAA.

Corporate Assurance, Risk and Secretariat Team

The CARS team combines the 5 functions of Health & Safety, Information Assurance & Security, Business Continuity, Risk and Secretariat to collectively strengthen and support the LAAs governance, our assurance strategies, risk management processes and provide support to the LAAs senior governance forums including the Board and Executive Leadership Team.

This role sits within Information Assurance & Security, a function that ensures the LAA appropriately protects and manages a significant volume of often very sensitive data relating to legal aid clients, our staff, legal aid providers and other third parties. Our work ensures the LAA meets its obligations under Data Protection legislation and UK Government security standards.

Job Summary

You will play a leading role in ensuring the LAA continues to manage its information assets in a secure and compliant manner, delivering improvements and ensuring ongoing compliance with legal and UK Government requirements relating to security and data protection. You will work with MoJ colleagues providing guidance and support to teams across the LAA and on cross-government projects to ensure that information assets are protected and used appropriately and ensure that LAA senior leaders have the necessary assurance. You will work on developing and maintaining a strong security culture within the LAA, working with staff at all grades and across the organisation to ensure a security conscious agency, as well as playing a key role in responding to security incidents.

Key Responsibilities:

• Provision of expert advice and support to stakeholders across the LAA on the application of Data Protection Legislation in their business area.
• Responding to often complex queries accurately in a timely manner.
• Provision of advice and support on data protection governance including Data Protection Impact Assessments, the LAA Information Asset Register and Data Sharing Agreements.
• Investigation of security incidents, maintaining LAA incident records and producing reports and trend analysis relating to LAA incidents.
• Working with business areas and stakeholders at all levels to drive process improvements with a view to improving compliance and/or preventing incidents.
• Responding to Data Subject Rights requests, Data Protection Complaints and other similar queries and correspondence from external parties.
• Support the work of LAA vetting contacts to ensure relevant staff are vetted to appropriate standards.
• Building and maintaining excellent relationships with key stakeholders across the LAA, wider MoJ and other government departments.
• Attend cross-MoJ security working groups and other relevant networks.
• Lead and maintain the LAA Information Assurance Champions network, chairing regular meetings, disseminating resources and guidance with a focus on driving down risk across the LAA.
• Support the LAAs wider security awareness culture by reviewing new guidance from technical authorities, regulatory bodies and government bodies.
• Review, publish and update LAA guidance and intranet resources to inform staff of their security responsibilities.
• Develop and deliver training for a range of stakeholders and help facilitate and deliver bespoke training on a range of data protection and security topics.
• Contribute to LAAs physical security assurance programme by conducting site audits and inspections and identifying improvements to physical security and site safety.
• Other work as required to contribute to the LAAs security culture and reduce security and data protection risks.
• This role may include line management of up to two EO staff.
• Travel to LAA sites across England and Wales as required, including occasional overnight stays.

Essential Knowledge, Experience and skills

• Experience of working in either a data protection or information security role.
• Experience of applying data protection legislation and ICO guidance to organisational processes and scenarios.
• Experience of or ability to support incident management, including identifying, triaging and responding to an incident, and briefing managers or senior leaders about incidents, their impact and lessons learned.

Desirable Knowledge, Experience and skills

• Recognised qualification in Data Protection or Information Security.

Person Specification

• Youll be confident in taking technical information and translating that into plain English for Senior Stakeholders.
• Youll have a desire to make positive change Information Assurance isnt about saying no, its about enabling developments in a way that responsibly manages associated risks.
• Youll work well with people and be able to maintain positive relationships whilst ensuring legislative obligations are met.
• Youll enjoy working in both a pro-active and re-active way, to be able to reprioritise effectively, especially during incident management.

Assessment approach

Application Process

To apply please submit a CV and Statement of Suitability showing how you meet the essential criteria in no more than 750 words.

Your statement should demonstrate your experience and your ability to do all of the three bullet points in the Essential Knowledge, Experience and skills listed above . Using examples can help strengthen your application.

Please note that we only require a CV and a Statement of Suitability for your application. The wording on this advert may suggest that an Experience question is also required, however this is not necessary.

Interview / assessment Process

If you are successful through the application stage, you will be invited to an interview / assessment centre in person or via Microsoft Teams where you will be assessed against the following:

Strengths relevant to the role

The following Behaviours:

• Delivering at Pace
• Making Effective Decisions
• Working Together

An exercise assessing your ability to respond to a security incident. To complete the exercise, you will need access to a computer, email account and software that can open Microsoft word documents. You will be required to share your screen and be on camera when completing the exercise. Further details of this will be shared at the interview.

Your Experience of implementing, promoting, or understanding diversity and inclusion policy - Diversity is the presence of difference, this can ...