Information Security Manager

Fawkes & Reece Group; City Of London; On-site; GBP 90,000 - 120,000; Full time

Job summary

Fawkes & Reece Group in London is seeking an experienced Information Security Manager to join Group IT and protect a global business. You will own security governance, risk management, and regulatory compliance, embedding security into daily processes and enhancing a security-aware culture.

Working with senior security leads, you will implement policies, manage risks, run DPIAs, coordinate audits, and deliver timely security improvements across the organisation.

Qualifications

• Minimum 3 years' experience in IT operations.
• Minimum 3 years' experience in an enterprise information security environment.
• 5 years' experience working with Microsoft information security tools, with evidence of improving compliance.
• At least 3 years' experience maintaining an information security-accredited environment (ISO 27001 and Cyber Essentials Plus).
• Strong knowledge of governance, risk, data protection and compliance.

Responsibilities

• Develop, implement and maintain information security policies and governance frameworks.
• Manage information security risks, maintain the risk register and oversee remediation.
• Ensure compliance with ISO 27001, GDPR and Cyber Essentials Plus.
• Support data protection officer with data protection matters (DPIAs).
• Coordinate audits and liaise with security teams and external providers on risk.
• Produce management reports on security performance and compliance.
• Lead security-related projects and continuous improvement initiatives.
• Provide security guidance to stakeholders and project teams.

Skills

Governance & risk

Data protection

Stakeholder management

Security awareness

Cyber security

Education

ISO 27001 Foundation

CISSP or CISM (advantageous)

ITIL Foundation

Tools

Microsoft Purview

Entra ID

Microsoft Defender Security

Cyera

Microsoft Copilot

Microsoft Word/Excel/Outlook

Job description

We are looking for an experienced and proactive

Information Security Manager

to join our Group IT function in London. This is an excellent opportunity for an information security professional to play a key role in protecting a global business, strengthening security governance and ensuring compliance with industry standards and regulatory requirements.

Working closely with the Senior Information Security Manager, Cyber Security Manager and wider business, you will take ownership of information security policies, risk management, data protection and business continuity. You will play a hands‑on role in embedding security into everyday business processes, improving compliance and promoting a strong security‑aware culture across the organisation.

Key Responsibilities

• Develop, implement and maintain information security policies, procedures and governance frameworks.
• Manage information security risks, maintain the risk register and oversee remediation activities.
• Ensure compliance with

ISO 27001, GDPR and Cyber Essentials Plus, alongside relevant contractual and regulatory requirements.

• Conduct risk assessments, internal audits, compliance reviews and Data Protection Impact Assessments (DPIAs).
• Support the management of security incidents, business continuity planning and incident response exercises.
• Maintain ISO 27001 documentation, including the Statement of Applicability, and coordinate internal and external audits.
• Work closely with Cyber Security, Group IT, HR and external service providers to assess risks and implement effective security controls.
• Provide security guidance to stakeholders, customers and project teams, ensuring security requirements are embedded into new and existing services.
• Promote security awareness through training, onboarding and ongoing knowledge sharing.
• Produce regular management reports and executive updates on security performance, risks and compliance.
• Manage security-related projects and continuous improvement initiatives, ensuring timely delivery and successful adoption.
• Support the Data Protection Officer with data protection matters, including Data Subject Access Requests where required.

About You

You will be a commercially aware and solutions-focused information security professional with the confidence to engage stakeholders at all levels. You will combine strong technical understanding with excellent governance, risk and compliance expertise, taking a pragmatic approach to managing risk and improving security across the business.

You will also bring:

• At least

3 years' experience in IT operations and

3 years' experience within an enterprise information security environment.

• At least

5 years' experience working with Microsoft information security tools, with evidence of improving compliance.

• At least

3 years' experience maintaining an information security-accredited environment, including ISO 27001 and Cyber Essentials Plus.

• Strong knowledge of information security governance, risk management, data protection and compliance.
• Experience working with technical and cyber security teams to assess risks and deliver remediation plans.
• The ability to manage multiple projects, priorities and change initiatives simultaneously.
• Excellent communication, analytical, problem-solving and stakeholder management skills.
• A strong customer-focused approach, with the ability to explain security requirements clearly to both technical and non-technical audiences.

Technical Skills & Qualifications

Experience with the following tools and technologies would be beneficial:

• Microsoft Purview, Entra ID and Microsoft Defender Security.
• Cyera and Microsoft Copilot.
• Microsoft Word, Excel and Outlook.

Relevant qualifications or equivalent practical knowledge are expected, including Microsoft Information Protection or Compliance products and ITIL Foundation. ISO 27001 Foundation, Auditor or Implementer qualifications, alongside CISSP or CISM, would be advantageous.