IT Risk & Security Manager

Totum Partners; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Hybrid work

Job summary

Totum Partners seeks the first dedicated IT Risk & Security lead to stand up and own the security function from the ground up in a professional services firm.

You will drive ISO 27001 certification, develop governance and risk frameworks, and manage supplier assurance and client audits while partnering with managed service providers to strengthen security posture.

Qualifications

• Proven experience leading ISO 27001 implementation and certification.
• Strong background in Information Security Governance, Risk and Compliance (GRC).
• Comfortable engaging with senior stakeholders and balancing strategy with delivery.

Responsibilities

• Establish and lead the information security function from the ground up.
• Lead the firm's ISO 27001 certification journey.
• Develop security policies, governance and risk framework.
• Manage supplier assurance and client security audits.
• Oversee cyber risk and compliance activities and vendor security posture.
• Embed security across the business as new technologies (including AI) are adopted.

Skills

ISO 27001

GRC

ISMS

Security Governance

Stakeholder mgmt

Job description

This is a unique opportunity to become the first dedicated IT Risk & Security hire within a professional services firm.

Reporting directly to the Head of IT, you'll be responsible for establishing and leading the firm's information security function from the ground up. This is a standalone, hands‑on role, ideal for someone who enjoys taking ownership, building security frameworks and making a real impact within the business.

A key priority will be leading the firm's journey to ISO 27001 certification, so we're looking for someone who has personally led an organisation through a successful ISO 27001 accreditation and understands what it takes to build and maintain an effective Information Security Management System (ISMS).

Alongside driving ISO 27001, you'll develop the firm's security policies, governance and risk framework, manage supplier assurance and client security audits, oversee cyber risk and compliance activities, and work closely with the firm's managed service providers to continually strengthen its security posture. You'll also play a key role in ensuring security is embedded across the business as new technologies, including AI, continue to be adopted.

About You

You'll have proven experience leading an ISO 27001 implementation and certification, together with a strong background in Information Security Governance, Risk and Compliance (GRC). You'll be comfortable working autonomously, engaging with senior stakeholders and balancing strategic planning with hands‑on delivery.

This role would suit someone who enjoys building rather than inheriting, wants genuine ownership of the security function and is excited by the opportunity to shape the future of information security within a highly respected professional services firm.

If you're looking for a role where you can leave a lasting legacy and build a security function from the ground up, we'd love to hear from you.

WFH Policy - 60% office / 40% home working