Information Security Lead

The Information Security (InfoSec) Lead is a senior player-manager responsible for establishing and owning the information security policy framework and ISMS. This role leads ISO 27001:2022 certification, governs identity and access management, and ensures security standards are embedded across all engineering teams. Key Responsibilities Security Policy and ISMS Ownership • Establish and maintain the information security policy framework, ISMS risk register, risk treatment plan, and Statement of Applicability (SoA). • Lead the organisation through ISO 27001:2022 certification and ongoing surveillance audits; coordinate all departments on control implementation and evidence. • Conduct periodic policy reviews to ensure alignment with regulatory requirements and evolving threat landscapes. Identity, Access and Secure Development • Design and implement IAM controls including SSO, MFA, and PAM; govern user provisioning and access review processes. • Define secure development standards (e.g. OWASP); conduct security architecture reviews with the Applications Lead. • Configure and maintain email security gateways and endpoint protection platforms. Security Operations Oversight and Support • Provide strategic direction and escalation support to the Senior Security Engineer and SoC team. • Review security incident post-mortems and ensure effective remediation. • Manage security service providers and vendors, including MSSPs and penetration testing firms. • On-call availability is required to support 24x7 incident response coverage. Requirements Experience • 10+ years of progressive information security experience, with 3+ years in a lead or management role. • Demonstrated experience designing and implementing an ISMS and leading ISO 27001:2022 certification programmes. • Experience establishing IAM frameworks (SSO, MFA, PAM) and managing external audits and regulatory examinations. • Proven experience leading incident response, containment, and post-incident reviews in a production environment. • Experience managing MSSPs, penetration testing firms, and security tooling vendors; regulated industry background preferred. Technical Skills • ISMS design and operation: risk register, SoA, control framework, continual improvement • IAM platforms: SSO (e.g. Okta, Azure AD or equivalent), MFA, PAM (e.g. CyberArk, BeyondTrust, or equivalent) • Secure development frameworks: OWASP, SANS CWE Top 25 • Security architecture review methodologies and threat modelling • Email security gateways and endpoint protection platforms • ISO 27001:2022 control framework implementation across all domains Qualifications • Bachelor's degree or higher in Information Security, Computer Science, or a related discipline. • CISSP or CISM strongly preferred.