Information Security Manager - 12 month FTC

Hometrack; City Of London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Hometrack is seeking an Information Security Manager to lead our information security framework across data, technology and operations, ensuring compliance with banking and mortgage industry standards.

You will own ISO 27001, Cyber Essentials/Cyber Essentials Plus programs, manage audits, policies, and risk, and work with cloud, DevSecOps and business stakeholders to embed security by design and resilience across Hometrack's SaaS platforms.

Qualifications

• Proven experience as Information Security Manager or Senior Security Officer in Tech/FinTech.
• Direct experience owning ISO 27001 ISMS and Cyber Essentials/Cyber Essentials Plus end-to-end.
• Strong regulatory knowledge including GDPR, FCA, PRA and third-party risk management.

Responsibilities

• Lead maintenance and improvement of ISMS and certifications.
• Oversee governance, risk management, and policy updates.
• Collaborate with cloud, development and product teams to embed security by design.
• Manage budgets and drive cross-functional security initiatives across the business.

Skills

Information Security Leadership

Risk Management

Governance & Compliance

ISO 27001

Cyber Essentials

Regulatory Knowledge

Cloud Security (AWS/Azure)

Stakeholder Management

Security Architecture

Threat Modeling

Education

CISM

CISSP

CRISC

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor

Tools

Vulnerability Scanning

Penetration Testing

IAM

DevSecOps

Cloud Security

Job description

Hometrack's market-leading property data sets, valuation models, and risk insights are delivered via our suite of B2B SaaS applications for mortgage lenders, brokers, and more. We've led the market for over twenty years!

Our services are mission-critical to the UK's top banks, automating their mortgage offers. They're used daily by home builders, mortgage brokers, local councils, and more to make informed property purchasing decisions. We have an exciting strategy to serve an even wider section of the market, with innovative products and services.

As the Information Security Manager, you will lead Hometrack's information security framework, ensuring our data, technology, and operational practices meet the rigorous standards expected by our banking and mortgage lending partners.

Key Responsibilities

1. Governance, Compliance & Certifications

• Certification Ownership: Take accountability for the maintenance, auditing, and continuous improvement of Hometrack's ISO 27001 Certified Information Security Management System (ISMS) and Cyber Essentials / Cyber Essentials Plus certifications, working in close collaboration with our Risk and Compliance officer.
• Audit & Risk Management: Plan and oversee internal security audits, external surveillance audits, and maintain the corporate Risk Register, prioritising and tracking remediation activities.
• Policy Management: Author, update, and enforce information security policies, standards, and procedures in line with industry best practices and regulatory shifts.

2. Financial Services & Regulatory Alignment

• Client & Regulatory Assurance: Support the Risk and Compliance officer with financial client security assessments, due diligence questionnaires, and third-party risk audits.
• Banking & Lending Compliance: Maintain a strong working knowledge of regulatory expectations affecting UK/EU banking and mortgage markets (e.g., FCA guidelines, PRA operational resilience frameworks, DORA, and GDPR) to ensure Hometrack's solutions remain compliant.
• Third-Party Risk Management: Evaluate and monitor the security posture of Hometrack's vendors and technology suppliers.

3. Strategy & Continuous Improvement

• Security Strategy Roadmap: Act as a key contributor, helping to prioritise, and implement strategic security initiatives to continuously mature Hometrack's security posture.
• Security Awareness & Culture: Alongside the compliance and security owners deliver engaging security awareness training, phishing simulations, and guidance across all departments to foster a security-first culture.
• Incident Response & Resilience: Maintain, test, and continuously improve the Incident Response, Business Continuity, and Disaster Recovery plans.

4. Technical Collaboration & Support

• Collaborate closely with technical teams to embed "security by design" into software development and cloud architecture.
• Manage vulnerability management frameworks, penetration testing cycles, and threat modeling exercises, ensuring timely remediation of findings.
• Cross-Functional Collaboration: Exceptional ability to forge and sustain relationships across organisational boundaries, working alongside diverse teams to influence and prioritise technical backlogs effectively.
• Financial Oversight: Direct accountability for departmental budgets, ensuring operational cost efficiency and value-driven resource allocation.

Experience & Knowledge

• Information Security Leadership: Proven experience operating as an Information Security Manager or Senior Security Officer within a technology, FinTech, or PropTech environment.
• Financial Services Context: Direct experience working within, or closely servicing, the Financial Services sector-specifically banking, mortgage lending, or credit processing.
• Framework Mastery: Demonstrable experience owning and maintaining an ISO 27001 ISMS and Cyber Essentials / Cyber Essentials Plus from end to end.
• Regulatory Awareness: Solid understanding of financial regulatory standards, third-party risk requirements, and data protection laws (GDPR/DPA 2018).
• Technical Credibility: Broad understanding of cloud platforms (AWS/Azure), secure software development lifecycles (DevSecOps), network security, and identity/access management (IAM).
• Stakeholder Management: Exceptional communication skills with the ability to translate technical security concepts into business risk discussions for senior stakeholders and external enterprise clients.

Qualifications & Certifications (Desirable)

• Certified Information Security Manager (CISM)
• Certified Information Systems Security Professional (CISSP)
• Certified in Risk and Information Systems Control (CRISC)
• ISO 27001 Lead Implementer or Lead Auditor