Clyde & Co
Information Security Specialist
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Department: Information Security
Location: Glasgow
Contract Type: Permanent
Role: Information Security Specialist
Key Responsibilities
Training, Awareness & Human Risk
The chosen candidate will be accountable for the successful delivery and continuous improvement of Clyde & Co's security awareness programme, owning the relationship with training providers, developing engaging content and partnering with stakeholders across the firm to drive behavioural change and strengthen the firm's security culture.
- Lead the design, implementation and continuous improvement of the firm’s security awareness and human-risk management programme ensuring all content remains relevant, engaging, and aligned with emerging cyber threats, industry best practices, and firm-specific risks.
- Manage enterprise phishing simulation campaigns, awareness training initiatives and behavioural change activities to improve security culture and reduce cyber risk.
- Coordinate the delivery of annual security campaigns including Cyber Security Awareness Month (CSAM), mandatory training activities and targeted awareness initiatives.
- Monitor emerging threats, industry practices and security awareness trends, recommending improvements to strengthen organisational resilience and human-risk management capabilities.
- Maintain and manage initiative plans, milestones, dependencies and reporting for assigned security improvement programmes.
- Own and maintain a productive relationship with external vendors to ensure the quality, effectiveness and continuous improvement of awareness and training services.
- Monitor vendor performance against agreed service levels, success metrics, and contractual commitments, driving improvements where required.
- Produce tailored management reports, dashboards and presentations for senior leaders, providing meaningful insights into programme performance, compliance levels, user behaviour and areas of risk.
- Partner with senior stakeholders to increase engagement, improve training completion rates and promote a strong security culture throughout the firm.
- Present findings, recommendations, and programme updates to management in a clear, concise and business-focused manner.
Supply Chain Risk and Supplier Assurance
The chosen candidate will be responsible for maintaining effective oversight of Clyde & Co's third-party security risk exposure, providing proactive insight into emerging supply chain threats and vulnerabilities and ensuring the firm's supplier assurance processes remain current, risk-based and aligned to the firm’s IT&O Risk Management Framework. The role acts as a key advisor to the business, helping stakeholders understand and manage risks arising from the firm's external supplier ecosystem.
- Maintain, execute and enhance third-party and supply chain security risk management processes including tiering of suppliers by risk, periodic and ad hoc third-party information security assessments (TPISA) and ongoing assurance activities.
- Design and operate supplier security assessment mechanisms, including contractual security schedules, supplier risk questionnaires, attestations and contract review processes.
- Manage information security within the supplier relationship throughout the lifecycle, ensuring that supply chain risks, control deficiencies and remediation actions are identified, tracked and addressed in a timely manner.
- Collaborate with Information Security, IT, Procurement, Risk Management, Legal and business stakeholders to ensure security requirements are integrated into operational processes and supplier engagements.
- Monitor, analyse, and assess emerging supply chain security threats, industry trends, regulatory developments, geopolitical risks, and third-party security incidents to identify risks that may impact Clyde & Co's supply chain.
- Develop and maintain a comprehensive understanding of Clyde & Co's supplier estate, identifying areas of concentration risk, systemic risk, fourth-party dependencies, and critical supplier exposures.
- Continuously evaluate and improve third-party risk management processes, methodologies, assessment frameworks, and assurance activities to ensure they remain effective, proportionate, and aligned to the firm's risk appetite and evolving threat landscape.
- Establish and maintain meaningful assurance activities over key (critical) suppliers through the review of independent audits, certifications, penetration test summaries, security attestations, performance metrics, and other relevant evidence.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Email DLP and Information Protection
To continuously enhance Clyde & Co's Email DLP and Information Protection capabilities, ensuring the firm's confidential, sensitive, and client information is protected through effective preventative, detective, and responsive controls while enabling secure business operations and collaboration.
- In conjunction with the Risk department, continue the development and enhancement of email DLP capabilities and the associated rulesets to help reduce the risk of unauthorised disclosure or loss or misuse of firm and client information.
- Work with the Risk department, IT, InfoSec and other business stakeholders to assess data protection risks and define appropriate email DLP policies, effective alerting and monitoring and control requirements.
- Support the review, tuning and improvement of DLP alerts, policies and control effectiveness, ensuring that DLP capabilities remain proportionate, risk-based and aligned with business operations.
- Track DLP issues, exceptions, policy impacts and improvement actions, escalating material risks or control decisions through the appropriate governance channels.
Supplier Relationship Management
Conduct periodic service and security review meetings with strategic suppliers to keep abreast of new developments and updates, assess performance against agreed requirements, contractual obligations and risk tolerances.
Internal Audit
Support the successful renewal and ongoing maintenance of Clyde & Co's Cyber Essentials, Cyber Essentials Plus, and ISO 27001 certifications by coordinating evidence collection, tracking remediation activities, engaging stakeholders and assisting with audit requirements.
Reporting, Governance and Continual Improvement
- Facilitate/establish and report on monthly metrics and Key Performance/Risk Indicators relating to third party/supply chain risk, human-risk, training/awareness and DLP.
- Produce management reporting, metrics and risk insights to demonstrate programme effectiveness and support governance decision-making.
- Facilitate continual improvement by investigating and utilising latest technologies such as Artificial Intelligence/Machine Learning and other process methodologies to help transform the delivery of the services with a focus on greater efficiency and accuracy.
- Stay abreast of technical, industry, regulatory and company changes and/or trends as they relate to cyber security, the legal industry, information management, InfoSec, technological standards/trends and IT efficiencies.
Stakeholder Engagement and Team Contribution
- Support security-related market assessments, supplier evaluations, proof-of-value activities, and procurement processes by providing subject matter expertise, requirements gathering, user feedback, and evaluation criteria where required.
- Contribute to the development of business cases, executive recommendations and decision-support materials for security improvement initiatives.
- Analyse insights and trends from security awareness activities, phishing simulations, user feedback, and third-party risk assessments, translating findings into actionable recommendations to improve security controls, processes and user behaviours.
- Work closely with Information Security, IT & Operations, Risk, Procurement, and business stakeholders to ensure security findings, lessons learned, and improvement opportunities are shared, acted upon and tracked through to resolution.
- Provide ongoing security education, guidance and best practice advice to IT teams and business stakeholders.
- Support wider Information Security team activities during periods of increased demand, project delivery, or where additional resource is required.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Essential Skills and Experience
- Proven experience of working in an Information Security and IT Risk Management role within a fast-paced environment. At least 5 years experience within the legal industry is ideal, but not essential.
- Operational knowledge of one or more international information security standards, risk management and control frameworks/practices e.g. ISF SOGP, ISO27001/2, ISO31000, IRAM2, NIST 800-53 or CSF and SOC2 reporting.
- Demonstrable experience of having worked with one or more of the following:
- Third Party Risk Management/Vendor Risk Management (TPRM/VRM) systems such as Mitratech Prevalent, Onetrust, Panorasys etc.
- Learning and development platforms offering both traditional course content and phishing and where available other xx-ishing capabilities (Proofpoint, Knowbe4, Hoxhunt or equivalent)
- Email or wider DLP platforms (Proofpoint Tessian, KnowBe4 Egress, Mimecast, Abnormal)
- AI based content/avatar creation/management applications (Synthesia, Colossyan or equivalent)
- Strong organisational skills and the ability to handle multiple conflicting priorities.
- Able to work to very tight deadlines under pressure and to assimilate information quickly.
- Strong interpersonal and stakeholder engagement skills, with the confidence, positivity and credibility to build effective relationships quickly across all levels of the Firm.
- Ability to adapt communication style and messaging to suit diverse audiences, including senior executives, partners, business stakeholders, end users, and technical teams, translating complex information into clear, meaningful, and actionable outcomes.
- An advanced familiarisation of electronic support tools such as Microsoft Excel, PowerPoint.
- A good working knowledge of electronic reporting and dashboard technologies such as Sharepoint, PowerBI is preferred but not essential.
- Excellent verbal and written communication skills, with the ability to explain operational concepts and technical terms in a way that non-technical people would understand.
- Demonstrates attention to detail with a high level of accuracy.
The Firm
When you work at Clyde & Co, you join a team of 500 partners, 2,400 lawyers, 3,200 legal professionals and 5,500 people in nearly 70 offices and associated offices worldwide. Our values are the principles that guide the decisions we make, unite us in our endeavours and strengthen our delivery, for both our clients and our firm. We work as one, excel with clients, celebrate difference and act boldly. We are committed to operating in a responsible way by progressing towards a diverse and inclusive workforce that reflects the communities and clients it serves. We are devoted to providing an environment in which everyone can realise their potential, using its legal and professional skills to support its communities. We do this through pro bono work, volunteering and charitable partnerships, and minimising the impact it has on the environment, including through our commitment to the SBTi Net-Zero standard and the setting of ambitious emissions reduction targets.
Our Commitment
Clyde & Co is proud to be an equal opportunities employer. Our values encourage us to support fairness, celebrate diversity and
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills