Head of Cyber Security

Purpose:

To lead 7IM’s cyber security function and own the day-to-day execution of the Cyber Security strategy across the 7IM Group. The role is accountable for protecting 7IM’s clients, colleagues, data, systems and services from current and emerging cyber threats, while supporting business growth, regulatory expectations and operational resilience. The Head of Cyber Security translates the IT and Cyber Security strategy into practical controls, measurable outcomes and clear reporting.

This includes cyber governance, security operations, vulnerability management, incident readiness, third-party cyber risk, security awareness, policy ownership and cyber assurance across on-premises, cloud and supplier-hosted services.

• Cyber Security Strategy & Governance:
  Own delivery of the Cyber Security strategy, maintain a clear cyber roadmap, control improvement plan and reporting cadence aligned to business priorities, regulatory expectations and risk appetite
• Security Operations & Threat Defence:
  Lead operational cyber defence across SIEM, endpoint protection, identity controls, email security, cloud security, vulnerability tooling and managed security service providers. Improve detection coverage, alert quality, escalation paths and response times
• Cyber Incident Response:
  Own cyber incident response playbooks and readiness for realistic scenarios including ransomware, data loss, account compromise, supplier failure, insider threat and social engineering. Coordinate technical response, evidence gathering, communications input, lessons learned and remediation tracking
• Operational Resilience:
  Work with IT, Risk, Compliance and business owners to support operational resilience requirements. Map cyber dependencies for important business services, test severe but plausible cyber scenarios, track vulnerabilities and support recovery within agreed RTOs
• Vulnerability Management & Assurance:
  Own vulnerability scanning, penetration testing, security testing and remediation governance. Prioritise issues based on exploitability, exposure and business impact. Report progress clearly and challenge overdue remediation
• Identity, Access & Data Protection Controls:
  Own cyber control standards for privileged access, conditional access, MFA, endpoint protection, data loss prevention and secure configuration. Support access review improvements and work with the DPO and Compliance teams on UK GDPR and data protection control requirements
• Third-Party Cyber Risk:
  Lead cyber security input into supplier due diligence, onboarding, renewal, exit planning and ongoing assurance. Support the management of material outsourcing and critical technology dependencies, including evidence of controls, resilience testing and incident notification requirements
• Policy, Standards & Control Framework:
  Maintain cyber security policies, standards and control baselines. Align controls to recognised frameworks such as ISO 27001, NIST Cybersecurity Framework, CIS Controls and Cyber Essentials, applying them in a proportionate way for 7IM
• Security Awareness & Culture:
  Lead colleague cyber engagement through targeted training, phishing exercises, scenario testing and practical guidance. Focus activity on the behaviours that reduce real risk
• Regulatory, Audit & Executive Reporting:
  Provide clear cyber MI, risk updates and remediation progress for governance forums including Cyber Committee, IT Governance and ARCC reporting. Support regulatory engagement, audits, client due diligence and external assurance activity
• Secure Change & Project Delivery:
  Embed security into change, architecture and project delivery. Review new systems, cloud services, AI tooling and infrastructure changes so risks are identified early and practical controls…