Global Information Security Manager

nxzen; Metropolitan Borough of Solihull; On-site; GBP 90,000 - 120,000; Full time

Job summary

nxzen is seeking a Global Information Security Manager to own information security governance and operations. You will lead the ISMS, cyber risk, incident readiness and security assurance, working with IT, offshore resources, SOC/providers, auditors and customers.

You will shape and mature the information security function, building the operating model, improving resilience, and embedding security into BAU as nxzen scales — with pragmatic leadership and clear ownership.

Qualifications

• Operator who makes controls work day to day.
• Experience serving Critical National Infrastructure clients.
• Ability to define structure and embed it into BAU.
• Strong collaboration with IT, compliance and senior leadership.

Responsibilities

• Own and mature ISO 27001 ISMS, risk treatment, and management review.
• Lead vulnerability governance and remediation with onshore/offshore teams.
• Own incident triage and cyber incident operating model.
• Define SOC operating responsibilities and playbooks.
• Lead security assurance for audits and customer requests.
• Coordinate supplier security assurance and due diligence.
• Produce monthly security MI and risk reporting.

Skills

Operations focus

Commercial judgement

Ownership

Collaborative leadership

Customer credibility

Pragmatic mindset

BAU embedding

Job description

We are seeking…

a pragmatic, hands-on information security leader who can bring structure, pace and clear ownership to nxzen’s cyber and information security environment. You will be comfortable operating across governance and execution: setting standards, managing risk, driving remediation, supporting incidents and working closely with IT, compliance, customers and senior leadership.

This is an opportunity to…

shape and mature the information security function in a growing business serving critical national infrastructure clients. You will have real scope to build the operating model, strengthen our ISO 27001 and resilience position, improve day-to-day control and assurance, and influence how security is embedded as nxzen scales — without inheriting a large, bureaucratic security organisation.

Key responsibilities

ABOUT THE ROLE

The Global Information Security Manager is nxzen's accountable day-to-day owner for information security governance and operations. The role will lead the ISMS, cyber risk and control environment, incident readiness, security assurance and the operating relationship with internal IT, offshore security resources, external SOC/providers, auditors and customers.

• Own and mature nxzen's ISO 27001 ISMS, including policies, risk treatment, control ownership, objectives, evidence and management review.
• Own the cyber risk register and monthly control/risk review, escalating material risk acceptance decisions to the Group COO / appropriate executive.
• Lead vulnerability governance, remediation ageing and control effectiveness, working with onshore and offshore technical resources on execution.
• Own incident triage and the cyber incident operating model; lead material incidents with Group COO involvement and specialist support where required.
• Define and embed SOC operating responsibilities, escalation paths, playbooks and effectiveness testing.
• Own security assurance for audits, certifications and customer requests, with specialist technical support used selectively for complex matters.
• Lead BCDR security governance and support the broader business continuity programme, ensuring security and technology dependencies are understood and tested.
• Own information‑security policies and standards, including identity/access, device/security requirements and supplier security expectations.
• Coordinate supplier security assurance and third‑party information‑security due diligence.
• Drive recurring security awareness with People and Ch.
• Produce clear monthly/quarterly security MI, risk and control reporting for the Group COO and ExCo/Board.

What we’re looking for

• An operator rather than a policy-only security professional: someone who will make controls work day to day.
• Commercial judgement and proportionate risk thinking, particularly in a business serving Critical National Infrastructure clients.
• Confidence to challenge constructively and esc…
• High ownership and follow-through without building unnecessary bureaucracy.
• Someone comfortable creating structure from an immature starting point and then embedding it into BAU.
• A collaborative leader who can work effectively with Jagadish/IT, Tracey/Compliance, P&C, Delivery, Finance, offshore teams and senior cyber specialists.
• Customer-facing credibility: able to explain nxzen's security position clearly without overclaiming maturity.
• A pragmatic mindset that balances security, user experience, delivery speed and cost.

Nice to have

• Experience in utilities, energy, engineering, infrastructure, managed services or other regulated / Critical National Infrastructure sectors.
• Experience with NIS / CAF, Cyber Essentials Plus, Achilles or comparable customer/supplier assurance frameworks.
• Experience establishing or testing BCDR / cyber-resilience plans.