Information Security Awareness Lead

Key Responsibilities

• Security Awareness Programme Management
  • Manage all aspects of the organisation's security awareness training programme, including mandatory quarterly training for all employees.
  • Own the security awareness roadmap and annual campaign calendar, ensuring coverage of key risks and regulatory expectations.
  • Ensure awareness programme coverage across divisional and regional locations, coordinating local delivery and site visits.
  • Manage and administer the Proofpoint Security Awareness Platform, including training modules, phishing simulations and reporting.
  • Work with HRIS teams to deliver quarterly and ad hoc security training through Workday.
  • Respond to and manage reported phishing emails via PhishAlarm, ensuring appropriate handling and feedback to users.
  • Deliver monthly security awareness induction training for all new starters.
  • Run regular awareness webinars, lunch and learn sessions and other in person and virtual briefings.
  • Select, deploy and deliver role specific training for specialist job functions such as IT, Finance, HR and other high risk roles.
  • Propose, design and implement novel awareness initiatives (e.g. competitions, quizzes, games) to improve engagement and effectiveness.
• Phishing & Human Risk Testing
  • Own and manage the phishing testing programme, including regular phishing simulations, analysis of results and trends, and targeted follow up training.
  • Escalate risky user behaviour and repeat failures to line management in line with agreed processes.
  • Work with SecOps and Incident Response teams to incorporate real world attack patterns into testing and training.
  • Set up and manage restrictions on access to Uniphar resources for persistent failures.
• Physical & Behavioural Security Audits
  • Conduct physical USB testing (e.g. trojan USB drops) to assess user behaviour.
  • Perform clean desk audits across office locations.
  • Conduct unattended workstation locking audits and report findings.
  • Use audit outcomes to inform targeted awareness campaigns and improvements.
• Awareness Communications & Campaigns
  • Manage the Cybersecurity Intranet site, publishing regular security awareness updates and guidance.
  • Design, procure and distribute physical and digital awareness media, including posters, stickers, digital signage.
  • Deliver regular themed security awareness campaigns across all channels.
  • Lead the organisation's October Security Awareness Month, including campaign planning and training quizzes.
• Metrics, KPIs & Continuous Improvement
  • Produce regular metrics and reporting on training completion rates, programme reach and phishing simulation results.
  • Conduct user surveys to gather feedback and measure awareness maturity.
  • Incorporate survey results, metrics and incident data into continuous programme improvements.
• Collaboration & Stakeholder Engagement
  • Work closely with IT and SecOps to maximise delivery of security awareness messaging to end users, including system notifications and desktop backgrounds.
  • Coordinate with divisional IT and communications teams to localise awareness delivery.
  • Carry out divisional and regional site visits to distribute materials and deliver local workshops.

Skills & Experience

• Minimum of 5 years' experience in IT, Information Security, learning development or related role.
• Proven experience delivering security awareness, training or behavioural risk programmes.
• Strong understanding of phishing, social engineering and human centric cyber risks.
• Experience managing awareness platforms and learning delivery tools.
• Strong communication and presentation skills.
• Ability to engage effectively with both technical and non technical audiences.

We do not discriminate and welcome all responses.