Business Information Security Officer

DTG Global; Greater London; On-site; GBP 85,000 - 120,000; Full time

Job summary

DTG Global is seeking a Business Information Security Officer (BISO) to sit between central security and the business. You will own the ISMS and its certifications (ISO 27001 and Cyber Essentials Plus), run risk assessments and internal audits, and report clearly to senior management.

You’ll work with operational and delivery teams so security is built in early, and support client/supplier assurance for a client-facing firm.

Qualifications

• 5–10 years in security, risk or compliance.
• Experience running an ISMS rather than ticking over.
• Experience in professional services or client-facing regulated environments is a plus.
• Ability to influence senior stakeholders.

Responsibilities

• Own the ISMS and related certifications (ISO 27001, Cyber Essentials Plus).
• Run risk assessments and internal audits across your area.
• Report to senior management with clear, actionable insights.
• Work with operational and delivery teams to bake security in from the start.
• Support client and supplier assurance activities.

Skills

ISMS management

ISO 27001

Cyber Essentials Plus

Stakeholder management

Risk assessment

Internal audits

Client facing

Job description

A national professional services firm is looking for a Business Information Security Officer BISO to sit between its central security function and the business.

The role is the link between the two. You are who the business comes to when they want to launch something, change something, or answer a client's security questionnaire, and you are who the security function relies on to make sure its requirements work in practice.

You would own the ISMS and the certifications that go with it, ISO 27001 and Cyber Essentials Plus, run risk assessments and internal audits across your area, and report what matters to senior management clearly. Alongside that you would work directly with operational and delivery teams so security is built in early rather than added late, and support the client and supplier assurance work that comes with a client facing business.

It needs someone with five to ten years in security, risk or compliance, who has genuinely run an ISMS rather than kept one ticking over, and who can hold a room with senior stakeholders. Professional services or another client facing regulated environment will help.