Information Security Manager

Overview

In this role you will lead information security governance, policy development and risk management to protect a global business. You will collaborate with the Senior Information Security Manager, Cyber Security Manager and stakeholders to embed security into processes and improve compliance. You will drive security awareness, incident response preparation, and audits, contributing to a strong security culture and risk-aware organisation. This position offers impact across governance, data protection and continuity, aligned with a proactive Group IT function in London.

Responsibilities

• Develop and maintain information security policies, procedures and governance frameworks
• Manage information security risks, maintain risk register and oversee remediation
• Ensure compliance with ISO 27001, GDPR and Cyber Essentials Plus and related requirements
• Conduct risk assessments, audits, DPIAs and compliance reviews
• Support security incidents, business continuity planning and exercises
• Maintain ISO 27001 documentation and coordinate audits
• Collaborate with Cyber Security, Group IT, HR and external providers to implement controls
• Provide security guidance to stakeholders and project teams to embed requirements
• Promote security awareness through training and onboarding
• Produce management reports on security performance, risks and compliance
• Manage security-related projects and continuous improvement efforts
• Support Data Protection Officer with data protection matters

Key requirements

• At least 3 years’ experience in IT operations
• At least 3 years in an enterprise information security environment
• At least 5 years’ experience with Microsoft information security tools and improving compliance
• At least 3 years’ experience in an information security-accredited environment (ISO 27001, Cyber Essentials Plus)
• Strong knowledge of information security governance, risk management, data protection and compliance
• Experience working with technical and cyber security teams to assess risks and remediation
• Ability to manage multiple projects and priorities
• Excellent communication, analytical, problem-solving and stakeholder management skills
• Customer-focused approach with ability to explain security to technical and non-technical audiences
• Relevant qualifications or knowledge including Microsoft Information Protection/Compliance products and ITIL Foundation
• ISO 27001 Foundation/Auditor/Implementer and CISSP or CISM would be advantageous

• communication
• stakeholder management
• problem-solving
• Microsoft Purview
• Entra ID
• Microsoft Defender Security

…