Cyber Security Manager

Which?; Greater London; Hybrid; GBP 73,000 - 80,000; Full time

Benefits offered by this job

Hybrid work

Health insurance

Pension 6-11%

Discretionary death in service

Pluxee discounts

WFH policy

Job summary

Which? is seeking a Cyber Security Manager to lead the operational security domain in London. You will oversee security for infrastructure and cloud, mentor a small team, and partner with the wider business to maintain a resilient digital ecosystem.

You will shape security strategy, drive vulnerability management and embed a security-by-design culture across the product lifecycle, reporting to the Head of Information Security & Technology Risk.

Qualifications

• Experience in security strategy and governance.
• Strong incident management and vulnerability lifecycle skills.
• Proven infrastructure and cloud security expertise.
• Familiarity with PCI DSS and regulatory requirements.

Responsibilities

• Provide technical leadership to a security team (1 direct report).
• Lead security initiatives across Azure/AWS/M365 and other tools.
• Run a strategic vulnerability management program and patch processes.
• Coordinate with MSP for 24/7 monitoring, IR, and threat resolution.
• Define tooling improvements and own security toolsets.
• Advise development/engineering on secure product development.

Skills

Security strategy

Incident management

Infrastructure security

Vulnerability management

DevSecOps

Cloud security

Security governance

Stakeholder comms

Education

CISM

CISSP

PCI DSS familiarity

Tools

AWS

Azure

Microsoft Defender

Tenable One

Salesforce

Job description

This role offers a competitive salary, hybrid working (London with 2 days in the office, Thursdays mandatory), 28 days holiday a year plus Bank Holidays and a fantastic pension scheme offering 6% in year one and 11% after this.

Salary £73,000 - £80,000 per annum

Location: London/Hybrid (2 days in the office, Thursdays mandatory)

Please note: Although we acknowledge that the use of AI tools can be helpful, we want your application to represent you. Please ensure your CV and statement of suitability (if asked to send in this advert) reflect your own voice and experiences.

About the role

Are you a technical security expert who thrives at the intersection of strategy and hands‑on execution? We are looking for a Cyber Security Manager to lead our operational technical security domain. You will be the go‑to authority for infrastructure and cloud security, managing a focused team and partnering with the wider business to ensure our digital ecosystem remains resilient against emerging threats.

In this role, you won't just be monitoring dashboards; you will be shaping our security strategy, driving vulnerability management, and embedding a "security by design" culture across our product development life cycle.

This is a pivotal role where you will have direct influence over our security posture. You'll report directly to the Head of Information Security & Technology Risk, giving you a high‑visibility platform to drive change.

Key responsibilities include:

• Technical Leadership: Manage and mentor a small technical security team (currently 1 direct report), overseeing all technical aspects of security from Infrastructure to DevSecOps.
• Cloud & Infrastructure Custodian: Lead security initiatives across Azure, AWS, Google Workspace, Microsoft, and Salesforce. You will ensure our cloud environments and architecture meet the highest standards.
• Run a strategic vulnerability management program to enhance internal IT.
• Vulnerability Management: Serve as the primary point of contact for penetration testing, vulnerability and patch management. You'll coordinate with technical teams to ensure vulnerabilities are identified, negotiated, and remediated swiftly.
• Strategic Partnership: Work hand‑in‑hand with our Managed Service Provider (MSP) for 24/ 7 monitoring, incident response, and threat resolution.
• Capability maturity: Conduct gap analysis of current and future tooling to define improvements in tooling.
• Tool Ownership: Act as the internal expert and administrator on security tooling.
• Product Security: Provide security advice and guidance to development and engineering teams to ensure secure product development.
• Act as security champion for Which? infrastructure.

About you:

• Expertise: Strong technical knowledge of AWS, Microsoft 365, Azure, Microsoft defender, Tenable One and Salesforce (or a strong willingness to master the latter).
• Certifications: CISM, CISSP, or equivalent professional qualifications.
• Strategic Mindset: Proven experience in security strategy, incident management, and infrastructure security, vulnerability management and endpoint security.
• Communication: The ability to translate complex technical risks into "plain English" for non‑technical stakeholders. You are friendly, approachable, and a natural collaborator.
• Drive: You are a self‑starter who can manage your own workload and lead from the front to build and develop your team to accomplish security capabilities. We work hard and play hard.

• Practical experience with PCI DSS compliance.
• Background in Data Protection/Management.

The interview process for this role involves:-

• 30-minute screening call with members of the Security Team via MS Teams.
• 60-90 minute Competency-based and scenario-based interview via MS Teams

Benefits

We also have these benefits for you to consider:

• 35 hour working week
• Generous 28 days holiday a year plus bank holidays and the option to buy additional holiday days
• Excellent pension scheme – when you pay in 3%,Which? paysin 6% (rising to 11% after one year of service)
• Annual Award (depending on employee and company performance)
• Healthcare insurance & Private medical insurance and opportunity to participate in Vitality rewards programme (at 6 months)
• A discretionary death in service benefit provision equivalent to six times your annual salary
• Free access to Which? member content and free access to Which? money & legal helplines
• Free wills for all Which? employees, plus, partners of employees can make their will at cost price.
• Discount site Pluxee which offers large %% off every day shopping and holidays
• Work from (almost) anywhere” for 4 weeks of the year policy
• A great work‑life balance (all our roles are now hybrid), offering flexible working options e.g. part time or job shares where possible.

About Which?

Which? is the UK's consumer champion, here to make life simpler, fairer and safer for everyone. You can find out more about what we do, our people and culture as well as hints and tips on how to complete your application on our Careers site.

We're proud to be ranked 3rd in the ‘Top 25 Inclusive Employers' List 2024. We welcome applications from everyone, because we value diversity, and are committed to maintaining an inclusive culture where all can thrive and reach their full potential—because diverse perspectives help us better understand and positively impact consumers.

As a Disability Confident Leader, we ensure that everyone can apply and be part of our recruitment processes and so we'll make reasonable adjustments if you need them. Find out more about the Disability Confident Interview Scheme here.

Please note:

1. You must meet the essential criteria listed within the Role Profile, to have your application reviewed.
2. We are unable to accept applications by email. Only candidates who apply by completing the online application via the careers site will be considered.
3. We reserve the right to withdraw this advert at any given time due to the number of applications received.

• Cyber Security Manager.docx.pdf