Head of Cyber Security

Seven Investment Management; Greater London; On-site; GBP 150,000 - 190,000; Full time

Job summary

Seven Investment Management in London is seeking a Head of Cyber Security to lead 7IM’s cyber security function, owning day‑to‑day execution of the strategy across the group. The role protects clients, colleagues, data, systems and services from current and emerging threats while supporting growth, regulatory expectations and operational resilience.

The Head translates IT and Cyber Security strategy into practical controls, reporting and governance across on‑premises, cloud and supplier‑hosted

Qualifications

• Bachelor's degree in Cyber Security, Computer Science or related field.
• Proven experience leading cyber security teams in regulated environments.
• Certifications such as CISSP, CISM or CISSP desirable.
• Experience coordinating with external auditors, MSSPs, regulators and clients.

Responsibilities

• Own delivery of Cyber Security strategy, governance, and reporting.
• Lead security operations across SIEM, endpoint, identity, and cloud security.
• Develop and run cyber incident response playbooks and lessons learned.
• Support operational resilience and recovery planning with risk owners.
• Oversee vulnerability management, testing, and remediation governance.
• Manage third‑party cyber risk and supplier assurance.
• Embed security into change, projects, and new tech.

Skills

Cyber governance

Security operations

Incident response

Vulnerability management

Identity security

Control assurance

Education

Bachelor's degree in Cyber Security or related field

Job description

Purpose:
To lead 7IM’s cyber security function and own the day-to-day execution of the Cyber Security strategy across the 7IM Group. The role is accountable for protecting 7IM’s clients, colleagues, data, systems and services from current and emerging cyber threats, while supporting business growth, regulatory expectations and operational resilience. The Head of Cyber Security translates the IT and Cyber Security strategy into practical controls, measurable outcomes and clear reporting. This includes cyber governance, security operations, vulnerability management, incident readiness, third-party cyber risk, security awareness, policy ownership and cyber assurance across on-premises, cloud and supplier-hosted services.

Responsibilities

• Cyber Security Strategy & Governance: Own delivery of the Cyber Security strategy, maintain a clear cyber roadmap, control improvement plan and reporting cadence aligned to business priorities, regulatory expectations and risk appetite
• Security Operations & Threat Defence: Lead operational cyber defence across SIEM, endpoint protection, identity controls, email security, cloud security, vulnerability tooling and managed security service providers. Improve detection coverage, alert quality, escalation paths and response times
• Cyber Incident Response: Own cyber incident response playbooks and readiness for realistic scenarios including ransomware, data loss, account compromise, supplier failure, insider threat and social engineering. Coordinate technical response, evidence gathering, communications input, lessons learned and remediation tracking
• Operational Resilience: Work with IT, Risk, Compliance and business owners to support operational resilience requirements. Map cyber dependencies for important business services, test severe but plausible cyber scenarios, track vulnerabilities and support recovery within agreed RTOs
• Vulnerability Management & Assurance: Own vulnerability scanning, penetration testing, security testing and remediation governance. Prioritise issues based on exploitability, exposure and business impact. Report progress clearly and challenge overdue remediation
• Identity, Access & Data Protection Controls: Own cyber control standards for privileged access, conditional access, MFA, endpoint protection, data loss prevention and secure configuration. Support access review improvements and work with the DPO and Compliance teams on UK GDPR and data protection control requirements
• Third-Party Cyber Risk: Lead cyber security input into supplier due diligence, onboarding, renewal, exit planning and ongoing assurance. Support the management of material outsourcing and critical technology dependencies, including evidence of controls, resilience testing and incident notification requirements
• Policy, Standards & Control Framework: Maintain cyber security policies, standards and control baselines. Align controls to recognised frameworks such as ISO 27001, NIST Cybersecurity Framework, CIS Controls and Cyber Essentials, applying them in a proportionate way for 7IM
• Security Awareness & Culture: Lead colleague cyber engagement through targeted training, phishing exercises, scenario testing and practical guidance. Focus activity on the behaviours that reduce real risk
• Regulatory, Audit & Executive Reporting: Provide clear cyber MI, risk updates and remediation progress for governance forums including Cyber Committee, IT Governance and ARCC reporting. Support regulatory engagement, audits, client due diligence and external assurance activity
• Secure Change & Project Delivery: Embed security into change, architecture and project delivery. Review new systems, cloud services, AI tooling and infrastructure changes so risks are identified early and practical controls are built in
• Team Leadership & Supplier Management: Lead and develop cyber security colleagues and manage key cyber suppliers. Set clear outcomes, challenge performance, manage budgets where delegated and keep service delivery aligned to 7IM’s risk position

About You

Knowledge

• Cyber Security Leadership: Strong knowledge of cyber governance, security operations, incident response, vulnerability management, security architecture, identity security and control assurance
• Financial Services & Regulation: Good understanding of UK financial services regulation, including FCA expectations for systems and controls, operational resilience, outsourcing, third-party risk, incident reporting, UK GDPR and client asset/data protection considerations
• Technology & Cloud Security: Broad knowledge of Microsoft security platforms, Azure security, endpoint protection, network security, email security, secure configuration, logging, monitoring and hybrid infrastructure environments
• Control Frameworks & Assurance: Working knowledge of ISO 27001, NIST Cybersecurity Framework, CIS Controls, Cyber Essentials, ITIL, secure-by-design principles, penetration testing and audit evidence management
• Threat & Resilience Awareness: Current understanding of threat intelligence, ransomware, supply chain compromise, identity attacks, cloud misconfiguration, insider risk, AI-enabled threats and resilience testing methods relevant to wealth management

Qualifications

• Bachelor’s degree in Cyber Security, Computer Science, Information Technology or a related field, or equivalent professional experience
• Proven experience in leading cyber security teams, including experience in cyber operations, assurance activity or security improvement programmes in a regulated environment
• Relevant professional certifications are desirable, such as CISSP, CISM, CISMP, CCSP, Microsoft Security certifications, ISO 27001 Lead Implementer or Lead Auditor, or equivalent
• Experience working with external auditors, penetration testers, MSSPs, cyber insurers, regulators, clients or supplier assurance teams would be beneficial

Skills/Other relevant information

• Practical cyber leader who can move between executive discussion, technical detail and operational delivery without losing the thread
• Clear communicator who can explain cyber risk in plain English, make trade-offs visible and provide balanced recommendations to senior stakeholders
• Strong judgement under pressure, especially during incidents, supplier escalations, audit findings and competing remediation priorities
• Conscientious, accountable and comfortable challenging weak controls, poor evidence or slow remediation in a constructive way
• Able to prioritise based on risk, business impact and regulatory exposure, not noise or supplier pressure