Cyber Assurance Manager

Job title: Cyber Assurance Manager

Salary: PO6 £53,051 - £56,293

Hours: 37

Contract: Permanent

Location: Home and Office Based

As a Cyber Assurance Manager, you’ll play a key role in protecting Leeds City Council’s information systems and services from ever-evolving cyber threats. You’ll be part of a forward-thinking Cyber security function, ensuring our organisation remains robust, compliant, and trusted.

Leeds City Council is one of the largest employers in the region with over 14,000 employees. We seek to recruit and develop talented individuals who embody our council values and ambitions.

About you

As a Cyber Assurance Manager, you will thrive on: -

• Turning cyber security risks into practical actions that protect colleagues and citizens information, systems and services.
• Leading and working collaboratively with your team, IDS technical specialists, business leaders, and third parties to embed security into every day decision making.
• Assessing the effectiveness of security controls, identifying gaps and drive improvements that deliver measurable outcomes.
• Navigating a changing cyber threat landscape, balancing risk with business needs and finding proportionate solutions
• Translating complex technical issues into clear insights that enable teams to understand risk and act.

About the role

As our next Cyber Assurance Manager, you will bring: -

• A strong understanding of cyber security principles, frameworks and risk management.
• The ability to assess systems, policies and security standards.
• Excellent communication skills with the ability to explain complex concepts in plain English.
• A proactive, collaborative approach, with a focus on continual improvement.
• Integrity and a commitment to public service values.

The role is integral to our Cyber Security function to help ensure that our residents, partners and staff can rely on the confidentiality, integrity and availability of the information and systems they depend on every day. You’ll be integral to building and maintaining a culture of security across the organisation, supporting projects from the ground up and helping the team make informed decisions that protect Leeds City Council.

What we offer you

We take pride in offering the best employee experience, with benefits including:

• a competitive salary and annual leave entitlement plus statutory holidays
• membership of the West Yorkshire Pension Fund with generous employer contributions
• flexible and hybrid working arrangements subject to service requirements
• a clear career pathway and continuing professional development opportunities
• a range of staff benefits to help you boost your wellbeing and make your money go further

If you have any queries or would like an informal chat about the role please contact Peter Jordan emailpeter.jordan@leeds.gov.uk

A Disclosure and Barring Service (DBS) check against the Children’s or Adults’ barred list as applicable will be carried out on preferred candidates. Read our recruitment of ex-offenders policy.

We welcome applications from everyone and actively seek a diverse range of applicants from all backgrounds and cultures. We particularly encourage applications from, but not limited to, women, carers, veterans as well as LGBT+, ethnically diverse, disabled and care experienced people.

This role is based in the UK. Home Office guidance states that candidates must evidence their right to work in the UK prior to commencing employment, either as a UK or Irish citizen, under the EU Settlement scheme or having secured any other relevant work visa.

If you do not have the right to work in the UK, you must consider your own eligibility for sponsorship for a particular role through the Skilled Worker visaroute before applying. To be eligible for sponsorship you'll usually need to be paid the standard salary rate of at least £41,700 per year or meet one of the other eligibility criteria. Ensure you are eligible before applying.

Job Description

Special condition This post is subject to a BPSS check (including DBS). Please note that a criminal record will not necessarily be a bar to obtaining employment; this will depend on the circumstances and background to any offence.

Job purpose Collaborate with IDS colleagues and across business units to enhance the organisation’s cybersecurity posture while ensuring compliance with regulatory requirements and industry best practices. Responsible for leading and managing the organisation's cybersecurity assurance program, ensuring that risk management practices, policies, and procedures are in place to protect the company’s critical data and systems.

Responsibilities

• Lead role in implementing and maintaining our Cyber incident response plans. Chair Cyber assurance meetings and coordinate the incident response plan, crisis management, and post-incident reviews for cybersecurity breaches or vulnerabilities.
• Promote a strong culture of cyber security across the organisation, supporting the development and delivery of cyber security awareness training for staff while preparing reports on security assurance activities and findings for senior management.
• Manage, mentor, and develop a team of cybersecurity professionals who will be a central management point for the triage of alerts and response across different IDS teams. The team will fulfil an audit function to ensure policy and processes are being followed and will communicate security risks and assurance status failings to internal stakeholders and senior management, while providing strategic recommendations for risk mitigation and improvements.
• Lead the development, implementation, and continuous improvement of the Cyber Assurance program.
• Oversee the alignment of the cybersecurity risk management framework with business objectives and regulatory requirements.
• Provide guidance and leadership in establishing security policies, standards, and procedures across the organisation.
• Act as a liaison between IDS, business units, and external stakeholders to promote security best practices.
• Conduct regular risk assessments and vulnerability assessments to identify potential cybersecurity risks and threats to the organisation.
• Assess and manage third-party cybersecurity risks, ensuring compliance with contractual obligations and vendor assessments.
• Oversee internal and external audits to ensure adherence to regulatory standards and local government frameworks.
• Ensure that security compliance efforts are aligned with relevant laws and regulations, and lead audits to verify compliance with standards like PSN, PCI-DSS, etc.
• Develop and manage ongoing assurance processes to evaluate the effectiveness of security controls, including security testing, penetration testing, and vulnerability management programs.
• Coordinate the incident response planning, crisis management, and post-incident reviews for cybersecurity breaches or vulnerabilities.
• Collaborate with IDS teams to improve and maintain security configurations, monitoring, and incident handling.
• Prepare and present risk and compliance reports to senior leadership, identifying gaps, risks, and improvements.
• Communicate security risks and assurance status to internal stakeholders and provide strategic recommendations for risk mitigation.
• Ensure continuous reporting of the effectiveness of security controls and governance frameworks.
• Manage, mentor, and develop a team of cybersecurity professionals.
• Foster a culture of security awareness across the organisation, providing training and promoting best practices.
• Oversee the recruitment and hiring processes for cybersecurity staff to ensure appropriate talent acquisition.
• Stay up to date with emerging cybersecurity threats, technologies, and trends.
• Drive continuous improvement initiatives by adopting new tools, frameworks, and methodologies that enhance security posture and operational efficiency.
• Perform lessons learned and root cause analysis from security incidents to prevent future vulnerabilities
• The duties outlined are not meant as an exhaustive list and will also comprise any other duties within the spirit of the post commensurate with the job evaluation outcome for this post.

Qualifications CISSP (Certified Information Systems Security Professional) or similar cybersecurity certifications (e.g., CISM, CISA, CRISC) are essential. Other relevant certifications, such as CISA (Certified Information Systems Auditor), ISO 27001 Lead Implementer, or SOC 2 knowledge are desirable.

Essential requirements Candidates will only be shortlisted if they can demonstrate that they meet all the following essential requirements.

• Able to manage multiple priorities and work in a fast-paced, dynamic environment.
• Analytical mindset with problem-solving capabilities.
• Able to develop and maintain Cyber assurance processes to evaluate the effectiveness of security controls, including security testing, penetration testing, and vulnerability management programmes.
• Able to develop and maintain policies protocols that will need be adhered to across the organisation.
• Excellent communication skills, with the ability to present complex security topics in an understandable and actionable manner with a wide range of people including internal and external partners, customers and elected members through a variety of different methods
• Able to Coordinate the incident response planning, crisis management, and post-incident reviews for cybersecurity breaches or vulnerabilities. Collaborating with IDS colleagues to maintain and monitor security configurations and incident handling.
• Able to manage, mentor and develop a team of cybersecurity professionals providing leadership with direction with experience of stetting staff & service objectives, targets for performance and development strategies.
• Able to manage the Cyber assurance budget in line with the financial profile contained in the Essential service Capital scheme (ESP).
• In-depth knowledge of cybersecurity frameworks (e.g. Local Government CAF) and regulatory compliance requirements (PSN, PCI-DSS).
• In-depth knowledge of cybersecurity technologies, tools, and methodologies (e.g., SIEM, IDS/IPS, firewalls, DLP).
• In-depth understanding of cybersecurity standards, frameworks, risk management processes, and a proactive approach to threat mitigation.
• Significant experience with completing risk assessments, security audits, vulnerability assessments, and incident response management in relation to cybersecurity ensuring compliance with the relevant standards, frameworks, and regulations.
• Substantial experience in cybersecurity, risk management or assurance.
• Experience of working with a corporate risk management function, to ensure we have robust business continuity plans in place.
• Extensive experience of chairing Information Security Assurance and Compliance (ISAAC) Board and Cyber team meetings while co-ordinating associated activities across teams within the IDS directorate.
• Experience of motivating and appraising staff, identifying and progressing training and development

Essential Behavioural & other Characteristics

• Understand and embrace Leeds City Council Values and Behaviours and codes of conduct
• Committed to continuous improvement in all areas and work towards delivering the Best City Ambition of Health & Wellbeing, Inclusive Growth and Zero Carbon
• Able to understand and observe Leeds City Council policies and procedures.
• Carry out all duties having regard to an employee’s responsibility under Health, Safety and Wellbeing
• Willingness to actively participate in appraisal, training and development activities to ensure up, to date knowledge and skills.
• Flexible and adaptable to change to assist other services as required commensurate to grade.
• Be aware of and support difference and ensure equality for all working in an anti-discriminatory manner, upholding, equality & diversity of Leeds City Council.
• Recognise and appropriately challenge any incidents of racism, bullying, harassment, victimisation, and any form of abuse, reporting any concerns to the appropriate person
• The Council has adopted a flexibility protocol and the role will be expected to work within these parameters.

DesirablerequirementsCandidates are not required to meet all the following desirable requirements however these may be used to distinguish between candidates.

• Experience working with executive leadership and board-level reporting.
• Strong knowledge of cloud security, including AWS and Azure Cloud Platform.
• Knowledge of data privacy laws (e.g., GDPR) and their application in cybersecurity frameworks.