IT Security Manager

Onyx-Conseil; Greater London; On-site; GBP 75,000 - 85,000; Full time

Job summary

Onyx-Conseil is seeking an IT Security Manager in Central London with 5–8 years of proven expertise to lead information security across the organisation. You will advise corporate functions, drive security maturity, and ensure compliance with policies and standards while building strong relationships with senior stakeholders.

The role involves governance, risk, and collaboration with various business units, including security by design, third-party due diligence, and security awareness

Qualifications

• 5–8 years proven expertise in information security leadership roles.
• Experience presenting to senior stakeholders and championing ideas.
• Experience running information security risk governance processes and structures.
• Familiarity with ISO27001 and NIST CSF standards.
• Experience creating, implementing and assessing information security policies and standards.

Responsibilities

• Provide advice, support and guidance to all Company Corporate functions to assist them maintain information security maturity.
• Build networks and relationships across Company Corporate to promote Information Security.
• Act as subject matter expert on IT Security, including legal and regulatory compliance.
• Advise on controls and assist with development of standards aligned with Group security policies.
• Participate in BU projects, providing security assurance and governance.
• Support and encourage security by design across projects.
• Aid GRC to measure security compliance to policies.
• Drive BU/Divisional security roadmaps and address non-conformities.
• Coach and educate IT and Functions to increase security maturity.
• Be active in the Company's IS Security community.
• Produce, implement and standardise protocol/materials to support BU activities (asset registers, third party due diligence).
• Facilitate and chair security working group meetings.
• Engage with third party relationships to support the Company and affiliates.
• Assist procurement and tendering processes.
• Raise the security baseline controls and standardise where possible.
• Understand business requirements and align security to objectives.
• Support security operations to improve information security awareness (phishing campaigns).

Skills

Information security leadership

Stakeholder management

Risk governance

ISO27001

NIST CSF familiarity

Tools

Penetration testing

Job description

IT Security Manager

Our Client is a large international organisation who are looking to recruit an IT Security Manager with at least 5 to 8 years proven expertise.

Provide advice, support and guidance to all Company Corporate functions to assist them to maintain and improve their information security maturity.

To work collaboratively with all areas of the Company Corporate and build networks and relationships to promote Information Security.

• Act as subject matter expert on for IT Security, including legal and regulatory compliance
• Advise Company Corporate functions on how to achieve the required controls and assist with solutions to support them. Eg Support in the development of standards and their application in line with Group security policies.
• Participate in Company BU’s Projects giving support, guidance, control validation and overall security assurance. This could also involve sitting on major project steering committees.
• Support and encourage the ethos and methodology of security by design.
• Aid GRC to build, implement and facilitate a mechanism to aid BU’s to assess and measure their security compliance to policies.
• Drive the development of BU/Divisional security roadmaps. Giving oversight of key non-conformities to feed into the CISO roadmap.
• Coach, train and educate the Company IT and Functions to up skill and increase the security maturity in BU’s.

  Be an active member of the Company’s IS Security community, contributing to and leveraging the experience and lessons learned from other BU’s

• Produce, implement and standardise protocol and guidance material to support Business unit activities – examples – Asset register templates, third party due-diligence.
• Facilitate and chair the security working group meetings
• Engage and manage third party relationships to support the Company and its affiliates
• Aid Procurement and the tendering process
• Raising the security baseline controls and standardising where it makes sense to do so.
• Understanding the different business requirements and aligning to their objectives

Support Security operations to continuously improve information security awareness across the group, including phishing campaigns and associated reporting

Experience

• Experience in an information security risk leadership role within a large organisation.
• Confident in presenting, discussing and championing ideas and concepts with senior stakeholders.
• Experience of running information security risk governance processes and structures
• Familiarity with relevant industry standards for information security (e.g. ISO27001, NIST CSF)
• Experience of creating, implementing and assessing against information security policies and standards

Creativity

• Able to analyse complex, ambiguous problems and summarise clearly with a view to establishing practical solutions
• Able to “bridge the gap” between technologists and business-people, bringing to life information security risks to the business, while maintaining a pragmatic outlook on likelihood and impact of the risk and cost/complexity of the mitigation.
• Ensuring initiatives/programmes are anchored in best practice whilst still being highly practical/pragmatic.
• Ability to defuse situations and resolve conflict to a win-win outcome
• Influence others understand their views and agree ways of working that are acceptable to all parties.
• Support and manage budget

Business acumen

• Business acumen to understand business risks and the information security implications
• Able to identify when information security risks need to be escalated to achieve the right level of management visibility.
• Able to prioritise security risks and controls, differentiating the essential from the “nice to have”.
• Able to judge how to communicate messages to people to maximise buy-in and/or understanding.
• Able to analyse data with rigour & reach sound conclusions
• Can assess when further data gathering, or analysis will bring diminishing returns. Can place appropriate weight on prevailing (sometimes conflicting) evidence.

Responsibility

• Responsibility of information security incident management
• Responsibility for security assessments and assurance activities (e.g. penetration testing) and when to use them.
• Oversee and management of security compliance management and reporting in relation to any relevant regulatory or legal requirements
• Operational responsibility of management of third parties
• Responsibility for managing change management around project and change leadership.
• Able to judge the political and other people aspects of a situation, and tailor messages and approach to bring people along.
• Able to work with others, setting challenging but realistic targets for team members, and through coaching and appropriate guidance, securing a successful outcome.
• A positive collegiate approach to developing relationships and networks at all levels across the Company and the gravitas to work persuasively with senior stakeholders.

The Client and the role is based in Central London – and you will be required to be in the office at least 3 days week.

The salary for this position will be £75K + £85K plus Benefits.