Information Security Manager

Ocho are working with a growing technology and professional services business that partners with market-leading finance, insurance and technology organisations. They are looking for an Information Security Manager to take ownership of their security function, with a clear first priority: achieving and maintaining ISO 27001 certification. Reporting into the CTO, you will set security policy, assess and score risk, check controls work in practice and give clear, decision-ready recommendations to the business.

You won't be doing it alone. You will be supported by an experienced virtual CISO through certification and mentored through your first six months. Once certification is achieved, there may also be the opportunity to get involved in client-facing consultancy work, giving you insight into how some of the world's largest organisations approach security.

Key Responsibilities:

Running the ISMS to achieve and maintain ISO 27001 certification, including the Statement of Applicability, internal audits and management reviews Identifying, analysing and scoring security risks, and presenting High and Critical risks to the CTO with clear recommendations Supporting risk owners across the business to make and record informed risk decisions Writing and maintaining security policies and standards that reflect what is actually in place Leading the response to security incidents, including those involving personal data Assuring vulnerability management, patching and user access reviews delivered by the IT and Engineering teams Reviewing the security of new tools (including AI tools), vendors and contractors before adoption Ensuring customer security questionnaires are accurate and backed by real controls Acting as data protection lead, supporting UK GDPR compliance and subject access requests Running security awareness training, phishing simulations and incident response exercises Using automation and compliance tooling to reduce manual effort in evidence collection and reporting

Essential Criteria :
Typically 5 years' experience in information security, including at least 2 to 3 years running or supporting an ISO 27001 ISMS through audit Practical experience of information security risk management and policy writing Working knowledge of securing cloud productivity and collaboration platforms, endpoints, identity and cloud-hosted environments Knowledge of UK GDPR and data protection fundamentals Able to explain risk in plain business terms to non-technical leaders Able to influence and gain agreement without line authority ISO 27001 Lead Implementer or Lead Auditor certification, or working towards it Desirable:
Experience leading an organisation through first-time ISO 27001 certification Background in financial services or another regulated sector, or in a consultancy or professional services environment Familiarity with compliance automation, App Sec tooling, AI governance, Cyber Essentials or NIST CSF

Experience with supplier due diligence, customer security questionnaires, SOC providers and external auditors CISSP, CISM, CISA or CRISC, and relevant cloud security certifications What's on offer:
Hybrid working from their Belfast office Competitive salary and benefits package vCISO support and structured mentoring through your first six months A genuine ownership role with a direct line to the CTO in a growing business For a confidential chat, get in touch with Andy Harrison at Ocho People.

Skills:

ISO 27001 Risk Assessment Security Governance CISM Stakeholder Management Benefits:
Work From Home