Information Security & Risk Manager (Hybrid)

iFAST Global Bank Limited; Greater London; Hybrid; GBP 60,000 - 69,000; Full time

Benefits offered by this job

25 days annual leave entitlement plus

Pension scheme, 4% employer conribtion

Private Medical Insurance

60-40 Hybrid working after probation

Training and development

Free gym access in the building

Job summary

iFAST Global Bank Limited seeks an experienced Information Security & Risk Manager to lead ISO 27001 ISMS development and governance. You will drive risk assessments, implement security controls, and oversee threat intelligence, vulnerability management, and incident response across complex architectures.

The role requires strong regulatory knowledge (UK GDPR, FCA/PRA) and experience in data protection, resilience, and third-party risk.

Qualifications

• Bachelor's degree in Information / Cyber Security, Computer Science or a related discipline; equivalent professional experience may be considered.
• Relevant professional certifications are strongly preferred, for example CISM, CISSP, ISO 27001 Lead Implementer / Lead Auditor. Technology‑centric training and certification is an advantage.

Responsibilities

• Maintain and continuously improve the ISO 27001:2022 ISMS, including the Statement of Applicability, information security policies, standards and procedures, and the supporting documentation register, ensuring they remain current, mapped to control frameworks and audit-ready.
• Provide proactive security and data protection assurance for new initiatives, change and ongoing projects, ensuring security-by-design and privacy-by-design requirements are embedded from design through implementation.
• Conduct information security risk assessments to identify, evaluate and prioritise threats and control gaps, ensuring effective controls are agreed, implemented, tracked to closure and reflected in the risk register.
• Define, document and drive adoption of security controls that protect information flows across internal systems, third parties and public networks, in line with the ISMS and regulatory requirements.
• Act as the governance and oversight interface to the bank's cyber security operations, liaising with the specialist technical teams that run day‑to‑day security monitoring, detection and remediation, rather than performing these activities hands‑on.
• Conduct and coordinate threat intelligence and vulnerability management interpreting relevant intelligence, tracking identified vulnerabilities against remediation SLAs, coordinating timely remediation with technology teams and external providers, and keeping abreast of the evolving threat landscape.
• Support the maintenance and testing of incident response and crisis management procedures, contributing to the effective triage, coordination and post‑incident review of security and data protection events while minimising business disruption.
• Act as support for the bank's operational resilience and business continuity arrangements, and working closely relevant stakeholders and IT on disaster recovery.
• Conduct and contribute to business impact analyses, business continuity and IT disaster recovery plans and their testing (including the AWS cloud environment), helping ensure recovery objectives (RTO / RPO) are documented, achievable and evidenced, with lessons learned fed into improvements.

Skills

ISO 27001

Risk management

Threat intelligence

Incident management

Vulnerability management

Regulatory compliance

Cloud security

Governance reporting

Stakeholder engagement

Business continuity

Education

Bachelor's degree in Information / Cyber Security

CISM

CISSP

ISO 27001 Lead Implementer / Lead Auditor

Tools

SIEM

AWS

Job description

iFAST Global Bank Limited seeks an experienced Information Security & Risk Manager to lead ISO 27001 ISMS development and governance. You will drive risk assessments, implement security controls, and oversee threat intelligence, vulnerability management, and incident response across complex architectures.

The role requires strong regulatory knowledge (UK GDPR, FCA/PRA) and experience in data protection, resilience, and third-party risk.