Information Security Awareness Lead

Key Responsibilities:

Security Awareness Programme Management

• Manage all aspects of the organisation’s security awareness training programme, including mandatory quarterly training for all employees.
• Own the security awareness roadmap and annual campaign calendar, ensuring coverage of key risks and regulatory expectations.
• Ensure awareness programme coverage across divisional and regional locations, including coordination of local delivery and site visits.
• Manage and administer the Proofpoint Security Awareness Platform, including:
  • Training modules
  • Phishing simulations
  • Reporting and metrics
• Work with HRIS teams to deliver quarterly and ad‑hoc security training through Workday.
• Respond to and manage reported phishing emails via PhishAlarm, ensuring appropriate handling and feedback to users.
• Deliver monthly security awareness induction training for all new starters.
• Run regular awareness webinars, lunch‑and‑learn sessions, and other in‑person and virtual briefings.
• Select, deploy, and deliver role‑specific training for specialist job functions such as IT, Finance, HR, and other high‑risk roles.
• Run role‑specific awareness sessions, highlighting risks and attack scenarios relevant to specific job functions.
• Propose, design, and implement novel awareness initiatives (e.g. competitions, quizzes, games) to improve engagement and effectiveness.

              Phishing & Human Risk Testing

• Own and manage the phishing testing programme, including:
  • Regular phishing simulations
  • Analysis of results and trends
  • Targeted follow‑up training for repeat failures
• Escalate risky user behaviour and repeat failures to line management in line with agreed processes.
• Work with SecOps and Incident Response teams to incorporate real‑world attack patterns into testing and training.
• Set up and manage restrictions on access to Uniphar resources for persistent failures

              Physical & Behavioural Security Audits

• Conduct physical USB testing (e.g. trojan USB drops) to assess user behaviour.
• Perform clean desk audits across office locations.
• Conduct unattended workstation locking audits and report findings.
• Use audit outcomes to inform targeted awareness campaigns and improvements.

              Awareness Communications & Campaigns

• Manage the Cybersecurity Intranet site, publishing regular security awareness updates and guidance.
• Design, procure, and distribute physical and digital awareness media, including:
  • Posters
  • Stickers
  • Digital signage
• Deliver regular themed security awareness campaigns across all channels (physical media, desktop messaging, training modules).
• Lead the organisation’s October Security Awareness Month, including:
  • Campaign planning
  • Training
  • Quizzes, games, and surveys
  • Engagement reporting

              Metrics, KPIs & Continuous Improvement

• Produce regular metrics and reporting on:
  • Training completion rates
  • Programme reach
  • Phishing simulation results
  • Engagement and effectiveness
• Meet and report against defined KPIs for programme effectiveness.
• Conduct user surveys to gather feedback and measure awareness maturity.
• Incorporate survey results, metrics, and incident data into continuous programme improvements.

              Collaboration & Stakeholder Engagement

• Work closely with IT and SecOps to maximise delivery of security awareness messaging to end users, including:
  • System notifications
  • Pop‑ups and warnings
  • Desktop backgrounds and banners
• Coordinate with divisional IT and communications teams to localise awareness delivery.
• Carry out divisional and regional site visits to distribute materials and deliver local workshops.

Skills & Experience

Essential

• Minimum of 5 years’ experience in IT, Information Security, learning development or related role
• Proven experience delivering security awareness, training, or behavioural risk programmes.
• Strong understanding of phishing, social engineering, and human‑centric cyber risks.
• Experience managing awareness platforms and learning delivery tools.
• Strong communication and presentation skills.
• Ability to engage effectively with both technical and non‑technical audiences.

Please note that Uniphar is an equal-opportunity employer; we do not discriminate and welcome all responses.  #uniphargroup