IT Risk & Security Manager

Totum Partners; Southampton; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

Totum Partners, a leading professional services firm in the UK, seeks the first dedicated IT Risk & Security hire to establish and lead the security function from the ground up. Reporting to the Head of IT, you will own the design and delivery of our information security program and create robust governance, risk and compliance frameworks.

Key priorities include delivering ISO 27001 certification, building ISMS, policies and supplier assurance processes, and coordinating client security audits.

Qualifications

• Proven experience leading ISO 27001 implementation and certification.
• Strong background in Governance, Risk and Compliance (GRC).
• Ability to engage with senior stakeholders and work autonomously.
• Experience building security function from scratch.

Responsibilities

• Establish and lead the information security function from the ground up.
• Develop security policies, governance and risk framework.
• Manage supplier assurance and client security audits.
• Oversee cyber risk and compliance activities.
• Collaborate with MSPs to strengthen security posture.

Skills

ISO 27001

GRC

Information Security

Security Governance

Job description

This is a unique opportunity to become the first dedicated IT Risk & Security hire within a professional services firm.

Reporting directly to the Head of IT, you'll be responsible for establishing and leading the firm's information security function from the ground up. This is a standalone, hands-on role, ideal for someone who enjoys taking ownership, building security frameworks and making a real impact within the business.

A key priority will be leading the firm's journey to ISO 2701 certification, so we're looking for someone who has personally led an organisation through a successful ISO 2701 accreditation and understands what it takes to build and maintain an effective Information Security Management System (ISMS).

Alongside driving ISO 2701, you'll develop the firm's security policies, governance and risk framework, manage supplier assurance and client security audits, oversee cyber risk and compliance activities, and work closely with the firm's managed service providers to continually strengthen its security posture. You'll also play a key role in ensuring security is embedded across the business as new technologies, including AI, continue to be adopted.

About You

You'll have proven experience leading an ISO 2701 implementation and certification, together with a strong background in Information Security Governance, Risk and Compliance (GRC). You'll be comfortable working autonomously, engaging with senior stakeholders and balancing strategic planning with hands-on delivery.

This role would suit someone who enjoys building rather than inheriting, wants genuine ownership of the security function and is excited by the opportunity to shape the future of information security within a highly respected professional services firm.

If you're looking for a role where you can leave a lasting legacy and build a security function from the ground up, we'd love to hear from you.

WFH Policy - 60% office / 40% home working