Head of Information Security

CFC; London; On-site; GBP 80,000 - 120,000; Full time

Job summary

A leading company in London is seeking a Head of Information Security to lead their security program. This role involves managing key areas such as Third-Party Security Risk Management and Data Loss Prevention, ensuring compliance with various regulatory frameworks. The ideal candidate will have proven leadership experience and a strong background in security governance, vendor management, and risk assessment.

Qualifications

• Proven leadership in information security governance within regulated environments.
• Strong familiarity with UK, US, European, and Australian regulatory frameworks.
• Ability to translate complex regulatory requirements into practical controls.

Responsibilities

• Manage cyber incidents and support global coordination.
• Collaborate with legal and procurement for Third Party Risk Management.
• Oversee DLP strategy and incident response activities.

Skills

Leadership in information security governance

Regulatory frameworks knowledge

Risk-based approach

Vendor management

Incident response

Project management

Job description

Head of Information Security

Department: IT Operations

Employment Type: Permanent - Full Time

Location: London

Reporting To: Kirsty Kelly

Description

As Head of Information Security, you will report directly into the Group CISO, and be responsible for leading and managing key pillars of our security programme, with a primary focus on Third-Party Security Risk Management, Data Loss Prevention (DLP), Policy Governance, Security Training & Awareness, and Identity & Access Management (IAM).

You will work closely with the Group CISO to ensure high standards in your areas of responsibility and global adherence to security practices. The ideal candidate will have deep knowledge of regulatory frameworks such as NYDFS Cybersecurity Regulation, GDPR, and other European and Australian data protection laws, bringing a proactive, risk-based approach to security governance and controls operationalization.

About the role

This role involves acting as a member of the CISO’s leadership team, contributing to security strategy, budgeting, and cross-functional planning. Key responsibilities include:

1. Managing cyber incidents and supporting the CISO team in global coordination.
2. Managing vendor relationships, including renewals, negotiations, and contract updates.
3. Collaborating with legal, procurement, and operational resilience teams for end-to-end Third Party Risk Management and supply chain monitoring.
4. Leading third-party vendor assessment, onboarding, and ongoing monitoring.
5. Implementing risk-based frameworks for evaluating vendor security posture and supply chain evaluation.
6. Maintaining and updating security policies, standards, and procedures to reflect evolving threats and regulations.
7. Overseeing DLP strategy, tuning tooling and policies, and coordinating incident response activities.
8. Developing and measuring the effectiveness of security awareness and training programs.
9. Directing IAM strategy, including provisioning, access reviews, and privileged access management.
10. Partnering with IT to integrate IAM best practices into enterprise systems.
11. Ensuring security controls meet compliance obligations under NYDFS, GDPR, and other relevant regulations.

About you

The ideal candidate will have proven leadership in information security governance within regulated environments, with strong familiarity with UK, US, European, and Australian regulatory frameworks. You will:

1. Translate complex regulatory and technical requirements into practical controls, policies, and processes.
2. Work effectively with audit and compliance stakeholders during assessments and investigations.
3. Possess a strong background in security frameworks, standards, and regulatory requirements, including enterprise IT, cloud security, data protection, threat management, and incident response.
4. Be proficient in program and project management reporting.
5. Manage third-party vendors, MSSPs, and contract negotiations.

Core Values

Love what you do: We bring passion and intensity to our work, making a positive impact on colleagues and clients.

Challenge everything: We question the status quo and strive to improve continuously.

Have fun, be good: We enjoy our work, welcome diverse viewpoints, and treat everyone with respect.