Department: Information Security

Location: Glasgow

Contract Type: Permanent

Role: Information Security Specialist

Key Responsibilities

Training, Awareness & Human Risk
 

The chosen candidate will be accountable for the successful delivery and continuous improvement of Clyde & Co's security awareness programme, owning the relationship with training providers, developing engaging content and partnering with stakeholders across the firm to drive behavioural change and strengthen the firm's security culture

• Lead the design, implementation and continuous improvement of the firm’s security awareness and human-risk management programme ensuring all content remains relevant, engaging, and aligned with emerging cyber threats, industry best practices, and firm-specific risks. The chosen candidate will:
• Manage enterprise phishing simulation campaigns, awareness training initiatives and behavioural change activities to improve security culture and reduce cyber risk.
• Coordinate the delivery of annual security campaigns including Cyber Security Awareness Month (CSAM), mandatory training activities and targeted awareness initiatives.
• Monitor emerging threats, industry practices and security awareness trends, recommending improvements to strengthen organisational resilience and human-risk management capabilities.
• Maintain and manage initiative plans, milestones, dependencies and reporting for assigned security improvement programmes.
• Own and maintain strong a productive relationship with external vendors to ensure the quality, effectiveness and continuous improvement of awareness and training services.
• Monitor vendor performance against agreed service levels, success metrics, and contractual commitments, driving improvements where required.
• Produce tailored management reports, dashboards and presentations for senior leaders, providing meaningful insights into programme performance, compliance levels, user behaviour and areas of risk.
• Partner with senior stakeholders to increase engagement, improve training completion rates and promote a strong security culture throughout the firm.
• Present findings, recommendations, and programme updates to management in a clear, concise and business-focused manner.

Supply Chain Risk and Supplier Assurance

The chosen candidate will be responsible for maintaining effective oversight of Clyde & Co's third-party security risk exposure, providing proactive insight into emerging supply chain threats and vulnerabilities and ensuring the firm's supplier assurance processes remain current, risk-based and aligned to the firm’s IT&O Risk Management Framework. The role acts as a key advisor to the business, helping stakeholders understand and manage risks arising from the firm's external supplier ecosystem. The candidate will:

• Maintain, execute and enhance third-party and supply chain security risk management processes including tiering of suppliers by risk, periodic and ad hoc third-party information security assessments (TPISA) and ongoing assurance activities.
• Design and operate supplier security assessment mechanisms, including contractual security schedules, supplier risk questionnaires, attestations and contract review processes.
• Manage information security within the supplier relationship throughout the lifecycle, ensuring that supply chain risks, control deficiencies and remediation actions are identified, tracked and addressed in a timely manner.
• Collaborate with Information Security, IT, Procurement, Risk Management, Legal and business stakeholders to ensure security requirements are integrated into operational processes and supplier engagements. 
• Monitor, analyse, and assess emerging supply chain security threats, industry trends, regulatory developments, geopolitical risks, and third-party security incidents to identify risks that may impact Clyde & Co's supply chain.
• Develop and maintain a comprehensive understanding of Clyde & Co's supplier estate, identifying areas of concentration risk, systemic risk, fourth-party dependencies, and critical supplier exposures.
• Continuously evaluate and improve third-party risk management processes, methodologies, assessment frameworks, and assurance activities to ensure they remain effective, proportionate, and aligned to the firm's risk appetite and evolving threat landscape.
• Establish and maintain meaningful assurance activities over key(critical) suppliers through the review of independent audits, certifications, penetration test summaries, security attestations, performance metrics, and other relevant evidence.
   

Email DLP and Information Protection
 

To continuously enhance Clyde & Co's Email DLP and Information Protection capabilities, ensuring the firm's confidential, sensitive, and client information is protected through effective preventative, detective, and responsive controls while enabling secure business operations and collaboration. The candidate will:

• In conjunction with the Risk department, continue the development and enhancement of email DLP capabilities and the associated rulesets to help reduce the risk of unauthorised disclosure or loss or misuse of firm and client information.
• Work with the Risk department, IT, InfoSec and other business stakeholders to assess data protection risks and define appropriate email DLP policies, effective alerting and monitoring and control requirements.
• Support the review, tuning and improvement of DLP alerts, policies and control effectiveness, ensuring that DLP capabilities remain proportionate, risk-based and aligned with business operations.
• Track DLP issues, exceptions, policy impacts and improvement actions, escalating material risks or control decisions through the appropriate governance channels.

Supplier Relationship Management

• Conduct periodic service and security review meetings with strategic suppliers to keep abreast of new developments and updates, assess performance against agreed requirements, contractual obligations and risk tolerances.

Internal Audit

• Support the successful renewal and ongoing maintenance of Clyde & Co's Cyber Essentials, Cyber Essentials Plus, and ISO 27001 certifications by coordinating evidence collection, tracking remediation activities, engaging stakeholders and assisting with audit requirements.

Reporting, Governance and Continual Improvement

• Facilitate/establish and report on monthly metrics and Key Performance/Risk Indicators relating to third party/supply chain risk, human-risk, training/awareness and DLP.
• Produce management reporting, metrics and risk insights to demonstrate programme effectiveness and support governance decision-making.
• Facilitate continual improvement by investigating and utilising latest technologies such as Artificial Intelligence/Machine Learning and other process methodologies to help transform the delivery of the services with a focus on greater efficiency and accuracy.
• Stay abreast of technical, industry, regulatory and company changes and/or trends as they relate to cyber security, the legal industry, information management, InfoSec, technological standards/trends and IT efficiencies.

Stakeholder Engagement and Team Contribution

• Support security-related market assessments, supplier evaluations, proof-of-value activities, and procurement processes by providing subject matter expertise, requirements gathering, user feedback, and evaluation criteria where required.
• Contribute to the development of business cases, executive recommendations and decision-support materials for security improvement initiatives.
• Analyse insights and trends from security awareness activities, phishing simulations, user feedback, and third-party risk assessments, translating findings into actionable recommendations to improve security controls, processes and user behaviours.
• Work closely with Information Security, IT & Operations, Risk, Procurement, and business stakeholders to ensure security findings, lessons learned, and improvement opportunities are shared, acted upon and tracked through to resolution.
• Provide ongoing security education, guidance and best practice advice to IT teams and business stakeholders.
• Support wider Information Security team activities during periods of increased demand, project delivery, or where additional resource is required.

Essential Skills and Experience

• Proven experience of working in an Information Security and IT Risk Management role within a fast-paced environment. At least 5 years experience within the legal industry is ideal, but not essential.
• Operational knowledge of one or more international information security standards, risk management and control frameworks/practices e.g. ISF SOGP, ISO27001/2, ISO31000, IRAM2, NIST 800-53 or CSF and SOC2 reporting.
• Demonstrable experience of having worked with one or more of the following:
  
  - Third Party Risk Management/Vendor Risk Management (TPRM/VRM) systems such as Mitratech Prevalent, Onetrust, Panorasys etc.
  - Learning and development platforms offering both traditional course content and phishing and where available other xx-ishing capabilities (Proofpoint, Knowbe4, Hoxhunt or equivalent)
  - Email or wider DLP platforms (Proofpoint Tessian, KnowBe4 Egress, Mimecast, Abnormal)
  - AI based content/avatar creation/management applications (Synthesia, Colossyan or equivalent)
• Strong organisational skills and the ability to handle multiple conflicting priorities.
• Able to work to very tight deadlines under pressure and to assimilate information quickly.
• Strong interpersonal and stakeholder engagement skills, with the confidence, positivity and credibility to build effective relationships quickly across all levels of the Firm.
• Ability to adapt communication style and messaging to suit diverse audiences, including senior executives, partners, business stakeholders, end users, and technical teams, translating complex information into clear, meaningful, and actionable outcomes
• An advanced familiarisation of electronic support tools such as Microsoft Excel, PowerPoint.
• A good working knowledge of electronic reporting and dashboard technologies such as Sharepoint, PowerBI is preferred but not essential.
• Excellent verbal and written communication skills, with the ability to explain operational concepts and technical terms in a way that non-technical people would understand.
• Demonstrates attention to detail with a high level of accuracy.

The Firm

When you work at Clyde & Co, you join a team of 500 partners, 2,400 lawyers, 3,200 legal professionals and 5,500 people in nearly 70 offices and associated offices worldwide. Our values are the principles that guide the decisions we make, unite us in our endeavours and strengthen our delivery, for both our clients and our firm. We work as one, excel with clients, celebrate difference and act boldly. We are committed to operating in a responsible way by progressing towards a diverse and inclusive workforce that reflects the communities and clients it serves. We are devoted to providing an environment in which everyone can realise their potential, using its legal and professional skills to support its communities. We do this through pro bono work, volunteering and charitable partnerships, and minimising the impact it has on the environment, including through our commitment to the SBTi Net-Zero standard and the setting of ambitious emissions reduction targets.

Our Commitment

Clyde & Co is proud to be an equal opportunities employer. Our values encourage us to support fairness, celebrate diversity and prohibit all forms of discrimination in the workplace to allow everyone to excel at work. Therefore, we welcome and encourage all applications from suitably qualified individuals, regardless of background or identity. Learn more about our interview process.

A Note on Privacy

Please take a moment to read our privacy notice. This describes what personal information Clyde & Co (we) may hold about you, what it’s used for, how it’s obtained, your rights and how to contact us as a data subject.

If you are submitting a candidate as a Recruitment Agency Partner, it is an essential requirement and your responsibility to ensure that candidates applying to Clyde & Co are aware of this privacy notice.

This is the job description as constituted at present; however, Clyde & Co reserves the right to reasonably amend it in accordance with the changing needs of the business.