Key Responsibilities:
Security Awareness Programme Management
- Manage all aspects of the organisation’s security awareness training programme, including mandatory quarterly training for all employees.
- Own the security awareness roadmap and annual campaign calendar, ensuring coverage of key risks and regulatory expectations.
- Ensure awareness programme coverage across divisional and regional locations, including coordination of local delivery and site visits.
- Manage and administer the Proofpoint Security Awareness Platform, including:
- Training modules
- Phishing simulations
- Reporting and metrics
- Work with HRIS teams to deliver quarterly and ad‑hoc security training through Workday.
- Respond to and manage reported phishing emails via PhishAlarm, ensuring appropriate handling and feedback to users.
- Deliver monthly security awareness induction training for all new starters.
- Run regular awareness webinars, lunch‑and‑learn sessions, and other in‑person and virtual briefings.
- Select, deploy, and deliver role‑specific training for specialist job functions such as IT, Finance, HR, and other high‑risk roles.
- Run role‑specific awareness sessions, highlighting risks and attack scenarios relevant to specific job functions.
- Propose, design, and implement novel awareness initiatives (e.g. competitions, quizzes, games) to improve engagement and effectiveness.
Phishing & Human Risk Testing
- Own and manage the phishing testing programme, including:
- Regular phishing simulations
- Analysis of results and trends
- Targeted follow‑up training for repeat failures
- Escalate risky user behaviour and repeat failures to line management in line with agreed processes.
- Work with SecOps and Incident Response teams to incorporate real‑world attack patterns into testing and training.
- Set up and manage restrictions on access to Uniphar resources for persistent failures
Physical & Behavioural Security Audits
- Conduct physical USB testing (e.g. trojan USB drops) to assess user behaviour.
- Perform clean desk audits across office locations.
- Conduct unattended workstation locking audits and report findings.
- Use audit outcomes to inform targeted awareness campaigns and improvements.
Awareness Communications & Campaigns
- Manage the Cybersecurity Intranet site, publishing regular security awareness updates and guidance.
- Design, procure, and distribute physical and digital awareness media, including:
- Posters
- Stickers
- Digital signage
- Deliver regular themed security awareness campaigns across all channels (physical media, desktop messaging, training modules).
- Lead the organisation’s October Security Awareness Month, including:
- Campaign planning
- Training
- Quizzes, games, and surveys
- Engagement reporting
Metrics, KPIs & Continuous Improvement
- Produce regular metrics and reporting on:
- Training completion rates
- Programme reach
- Phishing simulation results
- Engagement and effectiveness
- Meet and report against defined KPIs for programme effectiveness.
- Conduct user surveys to gather feedback and measure awareness maturity.
- Incorporate survey results, metrics, and incident data into continuous programme improvements.
Collaboration & Stakeholder Engagement
- Work closely with IT and SecOps to maximise delivery of security awareness messaging to end users, including:
- System notifications
- Pop‑ups and warnings
- Desktop backgrounds and banners
- Coordinate with divisional IT and communications teams to localise awareness delivery.
- Carry out divisional and regional site visits to distribute materials and deliver local workshops.
Skills & Experience
Essential
- Minimum of 5 years’ experience in IT, Information Security, learning development or related role
- Proven experience delivering security awareness, training, or behavioural risk programmes.
- Strong understanding of phishing, social engineering, and human‑centric cyber risks.
- Experience managing awareness platforms and learning delivery tools.
- Strong communication and presentation skills.
- Ability to engage effectively with both technical and non‑technical audiences.
Please note that Uniphar is an equal-opportunity employer; we do not discriminate and welcome all responses. #uniphargroup
