Information Security and Integrity Manager

We are seeking an experienced and forward-thinking Information Security & Integrity Manager for a period of 12 months, to play a critical role in strengthening how the West Midlands Combined Authority (WMCA) protects, governs, and assures the use of its information assets and data.

This is a high-profile opportunity to lead the development and continuous improvement of the WMCA’s Information Security Management System (ISMS), ensuring the organisation has clear, evidence-based assurance over how information is handled, secured, governed, and retained. Working closely with senior leadership, audit, cyber security, data, and technology teams, you will help shape a robust security and governance framework that supports organisational transformation while ensuring compliance with ISO standards, UK GDPR, and best practice.

As the WMCA continues to evolve through ambitious regional programmes and increasingly complex digital services, this role will be central to embedding a culture of security, integrity, and accountability across the organisation. You will provide trusted assurance to leadership on information security risks, controls, compliance, and data integrity, while driving continuous improvement and ensuring security is embedded into operational and strategic decision-making.

We are looking for someone with strong expertise in information security governance, risk management, and data assurance, alongside the confidence to influence at senior level and lead organisation-wide improvements that deliver real impact for the region.

• Establish and maintain the organisation’s Cyber and Resilience Strategy
• Translate organisational needs into a coherent data security and lifecycle governance model
• Define security requirements for Business Continuity and Disaster Recovery
• Work with data owners and engineering teams to embed a culture of data literacy
• Ensure CAB/change includes security readiness criteria
• Maintain evidence packs and ISO/QMS artefacts with the Business Management Unit
• Maintain visibility of organisational data assets through evidence-based mapping
• Implement data quality assurance checkpoints in collaboration with Data Engineering
• Build strong working relationships across Technology and Insight service areas, Corporate PMO, Service Desk, suppliers, and operational teams and technical teams
• Act as a coordinator for the WMCA’s formal liaison with national and regional authorities
• Drive continuous improvement in operational processes

• Running an ISMS and aligning to ISO 27001 in a complex, multi-supplier environment
• Establishing policies, MSBs, risk registers, DPIAs, and supplier security
• CISSP/CISM or ISO 27001 Lead Implementer/Lead Auditor (or equivalent)
• Training or certification in data governance, data quality management, or metadata management (e.g., DCAM, CDMP, DAMA DMBoK-aligned training)
• Experience of working in Agile, Lean or Dev Ops-aligned delivery practices (e.g., Kanban, flow metrics, sprint planning, CI/CD awareness)
• Experience of working with CABs, release cycles or readiness reviews
• Experience assuring or governing data pipelines, data flows, integrations or data processing environments
• Experience implementing or overseeing data lifecycle governance, including classification, retention, minimisation and defensible deletion
• Experience working with Microsoft Purview, M365 compliance tooling or equivalent enterprise governance platforms
• Strong knowledge of UK GDPR/DPA 2018, ISO 27001, NCSC guidance
• Strong risk and assurance capability

The location for this role is 16 Summer Lane with at least 2 days a week spent in the office.

• Create your Careers Account. Register with your name, email address, and a password.
• Build your Profile. Upload your CV to help populate your career and education details.
• Write your Supporting Statement. Make sure to address each of the required essential criteria.
• Submit your application. Do one final check and once complete, click submit.

Your uploaded CV won’t be visible after submission. Our process is anonymised, and only the information in your profile is used for shortlisting
. Be thorough in…