Information Security Specialist

Department: Information Security

Location: Glasgow

Contract Type: Permanent

Role: Information Security Specialist

Key Responsibilities

Training, Awareness & Human Risk

The chosen candidate will be accountable for the successful delivery and continuous improvement of Clyde & Co's security awareness programme, owning the relationship with training providers, developing engaging content and partnering with stakeholders across the firm to drive behavioural change and strengthen the firm's security culture

• Lead the design, implementation and continuous improvement of the firm’s security awareness and human-risk management programme ensuring all content remains relevant, engaging, and aligned with emerging cyber threats, industry best practices, and firm-specific risks. The chosen candidate will:
• Manage enterprise phishing simulation campaigns, awareness training initiatives and behavioural change activities to improve security culture and reduce cyber risk.
• Coordinate the delivery of annual security campaigns including Cyber Security Awareness Month (CSAM), mandatory training activities and targeted awareness initiatives.
• Monitor emerging threats, industry practices and security awareness trends, recommending improvements to strengthen organisational resilience and human-risk management capabilities.
• Maintain and manage initiative plans, milestones, dependencies and reporting for assigned security improvement programmes.
• Own and maintain strong a productive relationship with external vendors to ensure the quality, effectiveness and continuous improvement of awareness and training services.
• Monitor vendor performance against agreed service levels, success metrics, and contractual commitments, driving improvements where required.
• Produce tailored management reports, dashboards and presentations for senior leaders, providing meaningful insights into programme performance, compliance levels, user behaviour and areas of risk.

Partner with senior stakeholders to increase engagement, improve training completion rates and promote a strong security culture throughout the firm.

Present findings, recommendations, and programme updates to management in a clear, concise and business-focused manner.

Supply Chain Risk and Supplier Assurance

Responsibilities

The chosen candidate will be responsible for maintaining effective oversight of Clyde & Co's third-party security risk exposure, providing proactive insight into emerging supply chain threats and vulnerabilities and ensuring the firm's supplier assurance processes remain current, risk-based and aligned to the firm’s IT&O Risk Management Framework. The role acts as a key advisor to the business, helping stakeholders understand and manage risks arising from the firm's external supplier ecosystem. The candidate will:

• Maintain, execute and enhance third-party and supply chain security risk management processes including tiering of suppliers by risk, periodic and ad hoc third-party information security assessments (TPISA) and ongoing assurance activities.
• Design and operate supplier security assessment mechanisms, including contractual security schedules, supplier risk questionnaires, attestations and contract review processes.
• Manage information security within the supplier relationship throughout the lifecycle, ensuring that supply chain risks, control deficiencies and remediation actions are identified, tracked and addressed in a timely manner.
• Collaborate with Information Security, IT, Procurement, Risk Management, Legal and business stakeholders to ensure security requirements are integrated into operational processes and supplier engagements.
• Monitor, analyse, and assess emerging supply chain security threats, industry trends, regulatory developments, geopolitical risks, and third-party security incidents to identify risks that may impact Clyde & Co's supply chain.

Develop and maintain a comprehensive understanding of Clyde & Co's supplier estate, identifying areas of concentration risk, systemic risk, fourth-party dependencies, and critical supplier exposures.

Continuously evaluate and improve third-party risk management processes, methodologies, assessment frameworks, and assurance activities to ensure they remain effective, proportionate, and aligned to the firm's risk appetite and evolving threat landscape.

Establish and maintain meaningful assurance activities over key(critical) suppliers through the review of independent audits, certifications, penetration test summaries, security attestations, performance metrics, and other relevant evidence.

Email DLP and Information Protection

To Continuously Enhance Clyde & Co's Email DLP And Information Protection Capabilities, Ensuring The Firm's Confidential, Sensitive, And Client Information Is Protected Through Effective Preventative, Detective, And Responsive Controls While Enabling Secure Business Operations And Collaboration. The Candidate Will

• In conjunction with the Risk department, continue the development and enhancement of email DLP capabilities and the associated rulesets to help reduce the risk of unauthorised disclosure or loss or misuse of firm and client information.
• Work with the Risk department, IT, InfoSec and other business stakeholders to assess data protection risks and define appropriate email DLP policies, effective alerting and monitoring and control requirements.
• Support the review, tuning and improvement of DLP alerts, policies and control effectiveness, ensuring that DLP capabilities remain proportionate, risk-based and aligned with business operations.
• Track DLP issues, exceptions, policy impacts and improvement actions, escalating material risks or control decisions through the appropriate governance channels.
  
  

Supplier Relationship Management

Ability to adapt communication style and messaging to suit diverse audiences, including senior executives, partners, business stakeholders, end users, and technical teams, translating complex information into clear, meaningful, and actionable outcomes

An advanced familiarisation of electronic support tools such as Microsoft Excel, PowerPoint.

A good working knowledge of electronic reporting and dashboard technologies such as Sharepoint, PowerBI is preferred but not essential.

Excellent verbal and written communication skills, with the ability to explain operational concepts and technical terms in a way that non-technical people would understand.

Demonstrates attention to detail with a high level of accuracy.

The Firm

When you work at Clyde & Co, you join a team of 500 partners, 2,400 lawyers, 3,200 legal professionals and 5,500 people in nearly 70 offices and associated offices worldwide. Our values are the principles that guide the decisions we make, unite us in our endeavours and strengthen our delivery, for both our clients and our firm. We work as one, excel with clients, celebrate difference and act boldly. We are committed to operating in a responsible way by progressing towards a diverse and inclusive workforce that reflects the communities and clients it serves. We are devoted to providing an environment in which everyone can realise their potential, using its legal and professional skills to support its communities. We do this through pro bono work, volunteering and charitable partnerships, and minimising the impact it has on the environment, including through our commitment to the SBTi Net-Zero standard and the setting of ambitious emissions reduction targets.

Our Commitment

Clyde & Co is proud to be an equal opportunities employer. Our values encourage us to support fairness, celebrate diversity and prohibit all forms of discrimination in the workplace to allow everyone to excel at work. Therefore, we welcome and encourage all applications from suitably qualified individuals, regardless of background or identity. Learn more about our interview process.

A Note on Privacy

Please take a moment to read our privacy notice. This describes what personal information Clyde & Co (we) may hold about you, what it’s used for, how it’s obtained, your rights and how to contact us as a data subject.

If you are submitting a candidate as a Recruitment Agency Partner, it is an essential requirement and your responsibility to ensure that candidates applying to Clyde & Co are aware of this privacy notice.

This is the job description as constituted at present; however, Clyde & Co reserves the right to reasonably amend it in accordance with the changing needs of the business.