Information Security Manager

British Land; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Job summary

British Land in Central London (Regent's Place, NW1) – Hybrid (4 days in office) is seeking an Information Security Manager to lead governance, risk management and compliance across the organisation, partnering with IT and business units to align security with objectives.

You will oversee policies, supplier risk assessments, audits, security awareness, and AI governance initiatives, delivering actionable guidance and ensuring adherence to GDPR and ISO 27001 standards.

Qualifications

• Demonstrated experience in information security governance, risk and compliance (GRC).

Responsibilities

• Governance: Develop and maintain information security policies, standards, and procedures.
• ] ,
• CoT_job_summary_short

Skills

GRC

Security governance

Audit coordination

Stakeholder communication

Risk management concepts

Policy development

AI governance awareness

Team collaboration

Information security

ISO 27001 knowledge

Tools

Surecloud

OneTrust

SIEM

Vulnerability scanning

Email security platforms

Job description

Information Security Manager

Department: Technology
Location: Central London (Regent's Place, NW1) – Hybrid (4 days in office)
Reports To: Head of Information Security
Type of Contract: Permanent

Responsibilities

Governance:

• Develop and maintain information security policies, standards, and procedures.
• Ensure alignment of security policies with business objectives and regulatory requirements.
• Monitor compliance with policies and conduct regular reviews and updates of security policies and procedures.
• Complete security assessments for third‑party suppliers, assets (buildings/retail) and projects to ensure adherence to cybersecurity policies and standards.
• Deliver and maintain the supplier risk assessment process.

Risk Management:

• Identify and assess information security risks across the organisation and maintain the risk register.
• Develop and implement risk mitigation strategies and action plans.
• Conduct regular risk assessments and audits to ensure compliance with security policies and standards.
• Monitor and report on the status of risk management activities.

Compliance:

• Ensure compliance with relevant laws, regulations, and industry standards (e.g., GDPR, ISO 27001).
• Coordinate and support internal and external audits and assessments.
• Develop and deliver security awareness and training programmes to employees.
• Maintain documentation and evidence of compliance activities.

Advocacy:

• Articulate the need for information security and compliance.
• Build strong stakeholder relationships across the business to enable effective communication and delivery of infosec objectives.
• Deliver infosec controls that are effectively designed and implemented.
• Identify security gaps and work with stakeholders to define remediation actions.

Collaboration:

• Provide guidance and support to business units on security‑related matters.
• Oversee security awareness training, including course management, rollout, and phishing tests.
• Manage the information security steering‑committee meeting – take minutes, organise meetings and actions.
• Support technology projects with security analysis of proposed solutions and highlight risks.
• Liaise with stakeholders on cyber‑security issues and provide future recommendations.
• Research and generate reports for technical and non‑technical staff.
• Give advice and guidance to staff on information security related issues.
• Define and monitor security policies and best‑practice standards.

Technical Engagement & Supplier Oversight:

• Maintain a working understanding of the organisation's security technology stack (e.g., SIEM, email security, DLP, endpoint, identity, vulnerability management) sufficient to engage credibly with the wider infosec team.
• Critically review and challenge supplier technical proposals, architectures and security testing reports (e.g., SOC 2, penetration test reports).
• Provide informed input into security testing scope (e.g., penetration testing, configuration reviews) and review remediation activity with suppliers.
• Support incident response and operational infosec activities as required, acting as an all‑round contributor in a small team.

AI Governance:

• Maintain awareness of AI developments relevant to information security, including risks and opportunities.
• Support the application of the organisation's AI governance framework, including risk review of AI use cases.
• Identify and pilot opportunities to leverage AI capability within the infosec function to improve productivity, coverage, and effectiveness.

About You

• Strong written and oral communication skills.
• Passionate about information security and proactive in recommending improvements.
• Enthusiastic, supportive team player.
• Strong Microsoft Office skills.
• Self‑motivated problem solver.
• Strong time management and organisational skills.
• Pragmatic – balance security and productivity.
• Understanding of information security risk management concepts.
• Experience working collaboratively within an IT department.
• Technically curious – comfortable engaging with the wider infosec team on operational and technical topics.
• Genuine interest in AI and its application to information security.
• Comfortable with breadth over depth – able to operate across multiple disciplines in a small team.

Required Skills

• Demonstrable experience in an information security role with significant exposure to GRC.
• Working knowledge of broader cyber security disciplines (e.g., supplier assurance, security testing, incident response, security operations).
• Experience with ISO 27001 ISMS implementation and management, and certification process.
• Strong Microsoft 365 skills, including familiarity with enterprise security tooling.
• Experience with risk management.
• Experience with third‑party risk management software (e.g., Surecloud, OneTrust).
• Working understanding of common cyber security domains (e.g., network security, endpoint protection, identity and access management, vulnerability management, security testing).

Preferred Skills

• ISO 27001 or NIST framework experience.
• ISO 27005 risk management experience.
• Experience with Surecloud/GRP alternatives.
• Exposure to AI governance frameworks (e.g., NIST AI RMF) or developing AI use‑case risk assessments.
• Exposure to property technology is an advantage.
• Experience reviewing penetration test reports, SOC 2 reports, or supplier security architectures.
• Experience with security tooling such as SIEM, email security platforms or vulnerability scanning.
• Hands‑on experience supporting incident response and security operations activities.
• Experience taking detailed minutes during senior or executive level meetings.

Desirable Accreditations

• ISO 27001 lead auditor/implementer certification.
• ISO 27005 risk management certification.
• CySIP, CISM or equivalent.
• CompTIA Security+ or equivalent foundational technical certification.