Information Security Awareness Lead

The Information Security Awareness Lead will own and drive Uniphar’s security awareness programme, helping reduce human-related cyber risk through engaging training, phishing simulations, communications campaigns, and behavioural testing. The role will work with Information Security, IT, HR, Communications, and business teams to deliver effective awareness initiatives, track programme performance, and continuously improve security behaviours across all regions and divisions.

Key Responsibilities:

Security Awareness Programme Management

• Manage all aspects of the organisation’ssecurity awareness training programme, includingmandatory quarterly training for all employees.
• Own thesecurity awareness roadmap and annual campaign calendar, ensuring coverage of key risks and regulatory expectations.
• Ensure awareness programme coverage acrossdivisional and regional locations, including coordination of local delivery and site visits.
• Manage and administer theProofpoint Security Awareness Platform, including:
  • Training modules
  • Phishing simulations
  • Reporting and metrics
• Work withHRIS teams to deliver quarterly and ad‑hoc security training throughWorkday.
• Respond to and manage reported phishing emails viaPhishAlarm, ensuring appropriate handling and feedback to users.
• Delivermonthly security awareness induction training for all new starters.
• Runregular awareness webinars, lunch‑and‑learn sessions, and other in‑person and virtual briefings.
• Select, deploy, and deliverrole‑specific training for specialist job functions such as IT, Finance, HR, and other high‑risk roles.
• Runrole‑specific awareness sessions, highlighting risks and attack scenarios relevant to specific job functions.
• Propose, design, and implementnovel awareness initiatives (e.g. competitions, quizzes, games) to improve engagement and effectiveness.

              Phishing & Human Risk Testing

• Own and manage thephishing testing programme, including:
  • Regular phishing simulations
  • Analysis of results and trends
  • Targeted follow‑up training for repeat failures
• Escalaterisky user behaviour and repeat failures to line management in line with agreed processes.
• Work with SecOps and Incident Response teams to incorporate real‑world attack patterns into testing and training.
• Set up and manage restrictions on access to Uniphar resources for persistent failures

              Physical & Behavioural Security Audits

• Conductphysical USB testing (e.g. trojan USB drops) to assess user behaviour.
• Performclean desk audits across office locations.
• Conductunattended workstation locking audits and report findings.
• Use audit outcomes to inform targeted awareness campaigns and improvements.

              Awareness Communications & Campaigns

• Manage theCybersecurity Intranet site, publishing regular security awareness updates and guidance.
• Design, procure, and distributephysical and digital awareness media, including:
  • Posters
  • Stickers
  • Digital signage
• Deliverregular themed security awareness campaigns across all channels (physical media, desktop messaging, training modules).
• Lead the organisation’sOctober Security Awareness Month, including:
  • Campaign planning
  • Training
  • Quizzes, games, and surveys
  • Engagement reporting

              Metrics, KPIs & Continuous Improvement

• Produce regular metrics and reporting on:
  • Training completion rates
  • Programme reach
  • Phishing simulation results
  • Engagement and effectiveness
• Meet and report against definedKPIs for programme effectiveness.
• Conduct user surveys to gather feedback and measure awareness maturity.
• Incorporate survey results, metrics, and incident data intocontinuous programme improvements.

              Collaboration & Stakeholder Engagement

• Work closely withIT and SecOps to maximise delivery of security awareness messaging to end users, including:
  • System notifications
  • Pop‑ups and warnings
  • Desktop backgrounds and banners
• Coordinate withdivisional IT and communications teams to localise awareness delivery.
• Carry outdivisional and regional site visits to distribute materials and deliver local workshops.

Skills & Experience

Essential

• Minimum of 5 years’ experience in IT, Information Security, learning development or related role
• Proven experience delivering security awareness, training, or behavioural risk programmes.
• Strong understanding of phishing, social engineering, and human‑centric cyber risks.
• Experience managing awareness platforms and learning delivery tools.
• Strong communication and presentation skills.
• Ability to engage effectively with both technical and non‑technical audiences.

Please note that Uniphar is an equal-opportunity employer; we do not discriminate and welcome all responses.  #uniphargroup