23825 - Information Security and Data Protection Manager

Ministry of Justice UK•National City, CA

9d•£35,335 - £42,859•Hybrid

About The Position

The Information Security and Data Protection Manager supports HM Courts & Tribunals Service (HMCTS) in delivering its information security and data protection objectives. The role helps HMCTS meet its obligations under UK GDPR, the Data Protection Act 2018, the Public Records Act 1958, and relevant Ministry of Justice (MoJ) and HMCTS policy frameworks. It supports the maintenance and operation of the Information Security Management System (ISMS), security assurance, audits, reviews, risk assessments, and compliance monitoring. The postholder provides tailored advice to stakeholders and helps identify and mitigate information security and data protection risks. They work collaboratively with teams across HMCTS and MoJ, including data protection, data incidents, service owners, information asset owners, delivery, digital and technology, and cyber security colleagues. The role also coordinates data protection documentation and shared-mailbox activity, tracks security risks and assurance actions, and contributes to improving guidance, processes, and controls. This is a permanent, full-time role with flexible working arrangements. The position is nationally based, with successful applicants expected to work from an HMCTS office three days per week, subject to business availability. Occasional travel to HMCTS sites may be required. The role can only be performed in the UK.

Requirements

Experience working in information security, data protection, governance, risk, compliance, or a related field.
Working knowledge of legislation such as UK GDPR, the Data Protection Act 2018, and the Public Records Act.
Experience supporting information security risk or compliance improvement activities.
Ability to provide clear advice and support to non-technical stakeholders.
Proven communication skills, including explaining risks, impacts, and mitigations clearly and proportionately.
Ability to manage multiple pieces of work with good time management.
Experience providing constructive challenge and feedback while maintaining positive working relationships.
Strong organisational and administrative skills and attention to detail.
Experience engaging and working with a range of teams and stakeholders to solve problems and achieve strong outcomes.
Ability to compile information and reporting in an accessible way and contribute to continuous process improvement.
Understanding of information security risk management concepts.

Nice To Haves

Experience using One Trust or similar Governance, Risk and Compliance platforms.
Practical experience with DPIAs, MOUs, and DSAs.
Experience supporting audits, risk assessments, or compliance reviews.
Knowledge of security frameworks and standards such as ISO 27001, NIST, CAF, or Gov Assure 007.

Responsibilities

Support the effective maintenance and operation of the Information Security Management System (ISMS).
Deliver assigned security and data protection improvement activities to agreed timescales.
Provide clear, tailored advice and support on data protection and information security to stakeholders across HMCTS.
Help stakeholders identify when a Data Protection Impact Assessment (DPIA), Memorandum of Understanding (MOU), or Data Sharing Agreement (DSA) is required.
Make recommendations on DPIAs, DSAs, and MOUs, consulting colleagues to ensure appropriate assurance and oversight.
Identify and escalate recurring issues, and propose improvements to guidance, templates, and ways of working.
Produce management information on volumes, risks, and trends, and provide ad-hoc reporting as required.
Support the HMCTS Information Security Lead in developing and managing a quality service and monitoring compliance with internal controls.
Engage collaboratively across HMCTS and maintain strong relationships with MoJ Data Protection and Security Teams and relevant internal teams.
Support data protection and information security assurance and compliance activities in line with business plans and objectives.
Maintain information security policies, standards, procedures, and guidance so they remain current and fit for purpose.
Track and report on security risks, incidents, vulnerabilities, audit actions, and control effectiveness.
Coordinate DPIAs, DSAs, and MOUs; maintain status and approval records; review documentation for clarity, completeness, and proportionality; ensure risks and mitigations are articulated; and request clarification or further information as needed.
Coordinate the HMCTS data protection shared mailbox, ensuring emails are handled promptly, assigned, escalated, or redirected as appropriate.

Benefits

Annual leave of 25 days on appointment, increasing to 30 days after five years’ service.
Option for qualifying staff to buy or sell up to three days of annual leave each year.
Paid public holidays and one privilege day.
Choice of Civil Service pension schemes.
Training and development opportunities.
Opportunity to join employee-run support networks.
Family-friendly policies, including opportunities for reduced hours or job sharing.
Flexible benefits, including voluntary benefits, retail vouchers, and discounts.
Paid paternity, adoption, and maternity leave.
Free annual sight tests for employees who use computer screens.