IT Security Manager

Role Overview

You will take ownership of the company’s cyber and information security posture, operating both strategically and hands-on to protect critical systems, data, and cloud environments. Day to day, that means steering security operations, reviewing architectures, running assessments, and guiding response efforts—while working closely with IT, risk, audit, and project teams to make sure security is baked into everything the organisation builds. Your work directly determines how resilient the business is against an ever-changing threat landscape and helps keep it aligned with regulatory and industry standards.

Key Responsibilities

• Own the day-to-day operation and continuous hardening of security infrastructure, including firewalls, intrusion detection and prevention, endpoint detection and response, privileged access management, network access control, and cloud-native security controls for AWS and Microsoft Azure.
• Plan and execute the technical security assessment programme—coordinating vulnerability scans, penetration tests, configuration reviews, and targeted risk assessments, then driving findings to closure with internal and external stakeholders.
• Develop, maintain, and enforce the full suite of information security policies, standards, and procedures, keeping them current with business needs, regulatory expectations, and recognised frameworks like ISO/IEC 27001 and NIST.
• Design and deliver a security awareness programme that changes behaviour, using regular campaigns on phishing, social engineering, password hygiene, data protection, remote working, and acceptable use.
• Act as the go-to security advisor for project teams, architects, and developers—embedding security-by-design from the earliest stages of system design, application development, integrations, and cloud adoption.
• Monitor the external threat environment and translate emerging risks into practical recommendations for leadership and operational teams.
• Lead the full incident response lifecycle—from detection and triage through containment, eradication, recovery, and post-incident lessons learned—while also providing security oversight for business continuity and disaster recovery plans.
• Set patching and vulnerability remediation requirements, track compliance across platforms, and manage relationships with cybersecurity vendors to ensure effective tooling and support.

Requirements & Qualifications

• A bachelor’s degree in computer science, information technology, cybersecurity, or a related discipline.
• A recognised professional certification such as CISA, CISM, CISSP, or CEH; additional cloud security certifications for AWS, Azure, or GCP are a strong plus.
• At least seven years of hands-on information security experience, with a minimum of two years leading or supervising technical security teams.
• Prior experience working in the financial services industry, with an understanding of the regulatory and audit expectations common in that sector.
• Proven ability to conduct and interpret penetration tests and vulnerability assessments, and to collaborate with internal and external auditors, risk, and compliance functions to close out findings.
• Deep working knowledge of security frameworks and standards, particularly ISO 27001 and NIST, and the ability to apply them pragmatically.
• Solid practical skills in IT risk management, cyber threat mitigation, and analytical troubleshooting—someone who can solve real problems, not just document them.
• Strong interpersonal and communication skills, comfortable working across cross-functional teams and translating technical risk into clear business language.
• A strategic, adaptable, budget-conscious mindset, able to align security investments with organisational priorities and manage vendor relationships effectively.