Information Security Officer; ISO

Full Time 35.625 hours per week, 9.5-day fortnight

Remote UK-wide, with occasional on-site member meetings and in-service days

HEFESTIS is a not-for-profit, member-owned cyber security shared service supporting education and public sector organisations across the UK. Through a collaborative delivery model, we help our members strengthen governance, manage cyber risk, improve resilience and build confidence in their ability to respond to an evolving cyber threat landscape. Our wider ecosystem includes established relationships with Scottish Government’s SC3, Acumen Cyber and Toronto Metropolitan University, giving members access to complementary expertise, capability and sector insight where needed.

Our CISO Office brings strategic cyber leadership, engagement management and operational delivery together in a single service. Chief Information Security Officers set direction and provide oversight, while Information Security Officers turn that direction into practical, measurable progress. This combination of leadership, hands‑on support and access to a wider network of specialist capability helps members strengthen cyber resilience without having to build every capability themselves.

As an Information Security Officer (ISO) in our CISO Office, you will report to the Head of Cyber Security Services (Managing CISO).

Working alongside our CISOs and member stakeholders, you will provide the day-to-day delivery and coordination that turns agreed priorities into practical output and sustained activity. You will run assessments, manage evidence, produce deliverables and keep member cyber security programmes moving.

This is not an administrative or document-production role. It is a delivery role. You will help members translate cyber security advice into organised, repeatable, measurable activity and resilience.

The exact mix depends on the service agreed with each member.

• Support member onboarding, discovery and baseline reviews.
• Work with member IT, Digital and Cyber teams, suppliers and the supporting CISO to progress agreed activities.
• Track actions, dependencies, decisions and delivery milestones.
• Escalate risks, delays and decisions that need CISO or member attention.

• Deliver capability, resilience, risk and control assessments against recognised standards.
• Collect, review and organise supporting evidence.
• Support evidence-based reviews of control coverage and effectiveness.

• Produce and maintain policies, standards, procedures, strategies and roadmaps.
• Maintain risk, action, decision and evidence records.
• Support the operation of member governance and risk‑management arrangements.

• Support and coordinate delivery of agreed improvement plans across our Omega (governance and assurance), Delta (operational improvement) and Sigma (advanced optimisation) Pathways.
• Help members implement and embed agreed policies, processes and ways of working.

• Coordinate cyber exercises, tabletop exercises, workshops and governance forums that build members' incident readiness, alongside the CISO Office team.

• Prepare reports, management information and service scorecards.
• Maintain service records and programme documentation.
• Contribute to the continual improvement of CISO Office services, templates and delivery methods.

We're looking for an organised, delivery-focused security professional who gets things done and brings others with them. Strong mid-level candidates are encouraged to apply.

• Solid experience in information security and…