Global Head of Security Manager

Role Purpose & Context

Role Summary

The Global Head of Security Manager is responsible for leading, shaping, and delivering a critical security function across our global operations. This could be anything from our Security Operations Centre (SOC) to Governance, Risk, and Compliance (GRC), or even our Cloud Security programme. You'll be the one making sure your team is effective, efficient, and constantly improving, which directly impacts our overall risk posture and ability to operate safely. Day-to-day, you'll be juggling people management, strategic planning, budget oversight, and making sure your function delivers on its promises. You're not just reacting to threats; you're building the capability to prevent them. When this role is done well, our organisation runs smoothly, our data is protected, and our customers trust us. When it's not, we're looking at potential breaches, regulatory fines, and a serious hit to our reputation. The challenge is balancing the daily grind with long-term strategic goals, all while keeping your team motivated and effective. The reward, honestly, is knowing you're protecting the business from some pretty nasty stuff.

Reporting Structure

• Reports to: Director of Security
• Direct reports: Roughly 10-25 people, which can include other managers and team leads.
• Matrix relationships: Cyber Security Manager, Head of Security Operations, GRC Lead, Principal Security Lead,

Key Stakeholders

Internal:

• SVP of Engineering
• Head of Product
• Legal & Compliance teams
• HR leadership
• Finance leadership
• Other Security Managers and Leads

External:

• External auditors (e.g., for ISO 27001, SOC 2)
• Security vendors and partners
• Industry peer groups and forums

Organisational Impact

Scope: This role directly shapes our organisational security strategy and capability within its domain. Your decisions will influence how we protect our assets, manage risk, and respond to incidents globally. You'll own a significant P&L, typically in the range of £500K-£2M, meaning you're directly responsible for how we invest in and manage security resources. You'll be building the teams and processes that keep us safe, which is pretty fundamental to our business.

Performance Metrics

Quantitative Metrics

1. Metric: Security Program Maturity
2. Desc: Improvement in our security posture against established frameworks.
3. Target: Improve maturity score against NIST CSF from 'Tier 2' to 'Tier 3' within 24 months for your specific function.
4. Freq: Quarterly reviews, annual external assessment.
5. Example: If your function is GRC, you'll show a clear progression in how we identify, protect, detect, respond, and recover, moving from a reactive stance to a more proactive, defined one.
6. Metric: Risk Register Reduction
7. Desc: Reducing the number of high-priority risks that fall under your remit.
8. Target: Reduce the number of 'High' or 'Critical' risks on the enterprise risk register by 20% annually for your function.
9. Freq: Monthly review with the Director of Security, quarterly with executive leadership.
10. Example: Identifying 10 critical vulnerabilities in Q1, and by Q4, having only 2 remaining, with clear acceptance or mitigation plans for those. It's about getting things fixed, not just finding them.
11. Metric: Budget Adherence
12. Desc: Managing your function's budget effectively, staying within allocated spend.
13. Target: Manage the multi-million pound security budget for your function to within +/- 5% of the plan.
14. Freq: Monthly financial reviews, quarterly budget reforecasts.
15. Example: If your annual budget is £1.5M, you'll aim to spend between £1.425M and £1.575M, showing smart spending and good forecasting.
16. Metric: Board Confidence Score
17. Desc: How confident the board feels about our security posture, specifically regarding your function.
18. Target: Achieve and maintain a >90% confidence rating from the Audit & Risk Committee in quarterly reviews for your area.
19. Freq: Quarterly board presentations and feedback sessions.
20. Example: After your quarterly update, the committee members consistently express high confidence in your team's ability to manage risks and deliver on security objectives, based on your clear reporting and strategic approach.

Qualitative Metrics

1. Metric: Team Development & Retention
2. Desc: How well you're building, mentoring, and retaining your team members.
3. Evidence: High team engagement scores (e.g., >75%), clear individual development plans for all direct reports, successful internal promotions, low voluntary attrition rates (<10% annually), positive 360-degree feedback from your team and peers.
4. Metric: Strategic Influence & Collaboration
5. Desc: Your ability to get other departments to buy into and prioritise security initiatives.
6. Evidence: Security requirements consistently integrated early into new product development cycles, other department heads proactively seeking your team's input, successful completion of cross-functional security projects (e.g., a Zero Trust rollout), positive feedback from key internal stakeholders on your collaborative approach.
7. Metric: Incident Post-Mortem Quality
8. Desc: The thoroughness and effectiveness of lessons learned after security incidents.
9. Evidence: Detailed post-incident reports that clearly identify root causes, actionable recommendations that are actually implemented, documented process improvements, a culture of blameless learning within your team, and a measurable reduction in repeat incident types.

Primary Traits

• Trait: Decisive
• Manifestation: When the chips are down, you're the one who makes the tough call to shut down a critical system during a breach to stop the bleeding, even if you don't have all the data. You'll commit to a single EDR vendor after a thorough evaluation and then stand by that choice, explaining the rationale clearly. You don't dither; you act.
• Benefit: During an incident, hesitation is fatal. Every second counts. A security programme without a clear, decisive strategy becomes a patchwork of ineffective tools and conflicting priorities. Your team needs a leader who can make the call and own it, especially when the pressure is on.
• Trait: Influential
• Manifestation: You're the sort of person who can persuade the Head of Engineering to dedicate 10% of their next sprint to fixing security tech debt, not because you're forcing them, but because you've clearly articulated the business risk. You'll convince the CFO that a new security programme isn't just a cost centre, but a business enabler that protects revenue and allows us to innovate safely. It's about building bridges, not walls.
• Benefit: As Global Head of Security Manager, you'll have accountability for a significant part of the organisation's security, but direct authority over only your own team. Your success hinges on your ability to persuade peers, other department leaders, and executives to prioritise security. If you can't get people on board, your initiatives will stall.
• Trait: Accountable
• Manifestation: When a phishing attack succeeds, you'll stand before the executive team and say, 'This happened on my watch,' and then present a clear remediation plan without blaming users or tools. You're quick to give public credit to your team for wins, but you take the hit when things go wrong. You own the outcomes, good or bad.
• Benefit: Trust is the ultimate currency in security. Accountability builds trust with leadership and fosters a blameless, learning-focused culture within your security team, which encourages people to report mistakes early. If your team sees you owning the tough stuff, they'll follow your lead.

Supporting Traits

• Trait: Calm Under Pressure
• Desc: The ability to think clearly, keep a level head, and command a room when everyone else is panicking during a major incident. You'll be the steady hand.
• Trait: Pragmatic
• Desc: You understand that 100% security is a myth. You'll focus on managing risk to an acceptable level, making smart trade-offs, and not chasing every shiny new tool or trying to eliminate risk entirely. It's about 'good enough' for the business, not 'perfect'.
• Trait: Articulate
• Desc: You can explain the risk of a complex vulnerability (like Log4j, remember that?) to the board of directors using an analogy they'll actually understand, without getting lost in technical jargon. You can tailor your message to your audience, whether it's a junior analyst or the CEO.
• Trait: Healthy Skepticism
• Desc: You naturally question assumptions, verify vendor claims, and trust but verify system outputs. You're not cynical, but you don't take things at face value either. This means you'll spot the gaps others miss.

Primary Motivators

1. Motivator: Making a Real Impact
2. Daily: You'll get a kick out of seeing your team's work directly prevent incidents, improve our security posture, and enable the business to innovate safely. You'll be driven by the measurable reduction of risk and the knowledge that you're protecting our 'crown jewels'.
3. Motivator: Building & Leading High-Performing Teams
4. Daily: You'll thrive on mentoring your direct reports, helping them grow their careers, and fostering a collaborative, learning-focused environment. Seeing your team succeed and develop new capabilities will be a major source of satisfaction.
5. Motivator: Solving Complex, Strategic Problems
6. Daily: The challenge of translating technical threats into business risks, designing enterprise-wide security programmes, and navigating organisational politics to get things done will energise you. You're not just fixing bugs; you're solving puzzles that protect the entire company.

Potential Demotivators

Honestly, this job isn't always glamorous. You'll spend a fair bit of time trying to prove the ROI of preventing a disaster that hasn't happened yet—that's the 'Budget Justification Fatigue' we all know. Expect to discover the marketing team has been using a new, unsanctioned SaaS platform to store customer PII for the last six months (that's 'Shadow IT Surprises'). You'll likely be tasked with securing a newly acquired company that has a completely different tech stack, zero documentation, and a 'move fast and break things' culture (hello, 'M&A Integration Nightmares'). Your SOC team might be drowning in thousands of low-fidelity alerts, and you'll worry that the critical one will be the needle in the haystack they miss ('Alert Fatigue Burnout'). You'll constantly be fighting the perception that Security's only purpose is to slow down innovation and block projects, rather than enabling the business to take risks safely (the 'Department of No' syndrome). And yes, you'll often be brought into a major new product launch a week before go-live and expected to 'bless' the architecture with no time for a proper security review ('Why weren't we involved sooner?').

Common Frustrations

1. Getting buy-in for security initiatives from teams who see it as 'extra work'.
2. Dealing with legacy systems that are impossible to patch or properly secure.
3. The constant battle against 'alert fatigue' and making sure your team isn't burnt out.
4. Translating complex technical risks into language that non-technical executives understand and care about.
5. The 'We Accept the Risk' button – when security flags a critical risk, but a business unit leader formally accepts it in writing to meet a deadline, shifting liability.

What Role Doesn't Offer

1. A quiet, predictable 9-to-5 job with no surprises.
2. The ability to make unilateral decisions without needing to influence others.
3. A role where you're solely focused on deep technical work without people management.
4. A guaranteed 'thank you' for preventing a breach that never happened.

ADHD Positives

1. The fast-paced, often unpredictable nature of security management, especially during incidents, can be highly engaging and stimulating.
2. The need to quickly pivot between strategic planning, team management, and incident response can suit a mind that thrives on variety and novelty.
3. Hyperfocus can be a superpower when deep-diving into complex security challenges or strategic programme design.

ADHD Challenges and Accommodations

1. Managing multiple long-term strategic programmes and detailed budget oversight might require strong organisational systems and tools (e.g., robust project management software, dedicated executive assistant support).
2. The volume of administrative tasks inherent in a management role could be challenging; we can explore delegating routine tasks or using AI tools for drafting reports.
3. We can work with you to structure your day, use visual aids for project tracking, and ensure clear, concise communication to help manage workload and focus.

Dyslexia Positives

1. Often brings exceptional spatial reasoning, pattern recognition, and 'big picture' strategic thinking—all crucial for understanding complex threat landscapes and designing robust security architectures.
2. Strong verbal communication skills can be a huge asset in influencing stakeholders and leading incident response efforts, where clarity under pressure is key.

Dyslexia Challenges and Accommodations

1. The heavy reliance on written reports, policy documents, and board presentations can be demanding. We'll support you with access to proofreading tools, AI-powered drafting assistants, and administrative support for critical documents.
2. We encourage the use of visual tools (diagrams, mind maps) for strategic planning and communication, and we value verbal presentations as much as written ones.
3. We can provide access to assistive technologies like text-to-speech software and offer flexible approaches to documentation and reporting.

Autism Positives

1. A strong logical and analytical mind, essential for dissecting complex security problems, designing robust controls, and understanding intricate systems.
2. A dedication to accuracy and detail can be invaluable in GRC, policy development, and ensuring compliance.
3. Direct, honest communication is highly valued, especially in a leadership role where clarity is paramount.

Autism Challenges and Accommodations

1. Navigating complex organisational politics and unspoken social cues can sometimes be challenging. We'll ensure clear expectations for stakeholder engagement and provide support in navigating these dynamics.
2. The need for frequent, often spontaneous, social interaction in a management role might require specific strategies. We can agree on preferred communication channels and meeting structures.
3. We offer a clear, structured environment where expectations are explicit, and we're open to discussing any specific sensory or communication needs to help you thrive.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Principal/Manager (L5)
2. Responsibilities: Set the vision and strategy for your assigned security function (e.g., SOC, GRC, Cloud Security), making sure it aligns with the overall business goals and risk appetite. This means looking 12-24 months ahead, not just reacting to today's threats.
3. Build and lead a high-performing team of security professionals, which includes hiring, mentoring, performance management, and career development. You're responsible for their growth and making sure they're delivering top-notch work.
4. Own the P&L for your security function, managing a budget typically between £500K and £2M. This involves making smart investment decisions in tools, training, and personnel, and justifying those costs to senior leadership.
5. Design and implement robust security programmes and processes within your domain. This isn't just about tweaking existing things; it's about transforming how we operate to improve our security posture significantly.
6. Represent the organisation externally on security matters related to your function, whether that's with auditors, key vendors, or at industry conferences. You'll be a visible leader in your field.
7. Drive continuous improvement across your function, regularly reviewing performance metrics, conducting post-mortems after incidents, and making sure lessons learned are actually implemented. We expect you to challenge the status quo.
8. Act as a trusted advisor to executive peers and senior leadership on security risks and opportunities within your area. You'll translate complex technical issues into clear business implications, helping them make informed decisions.
9. Supervision: You'll be largely self-directed, with quarterly objectives set with the Director of Security. We trust you to get on with it, but you'll have regular check-ins to discuss progress, challenges, and strategic alignment. Think of it as a partnership, not micro-management.
10. Decision: You'll have full authority for your function, including budget allocation up to £500K (with oversight for larger sums), hiring and firing decisions for your team, and vendor selection up to £100K. Organisational design within your function is yours to shape. Any board-level decisions or significant external commitments will require alignment with the Director of Security or CISO, but you'll be the one presenting the case.
11. Success: Success looks like a highly effective, motivated team that consistently meets its security objectives, a measurable improvement in our security posture within your domain, and strong relationships with internal and external stakeholders. You'll be seen as a leader who delivers and genuinely protects the business.

Decision-Making Authority

• Type: Strategic Direction for Function
• Entry: N/A
• Mid: N/A
• Senior: Propose strategy, get approval from Director of Security. You'll be the architect, but they sign off.
• Type: Budget Allocation (within function)
• Entry: N/A
• Mid: N/A
• Senior: Full authority up to £500K. Over that, you'll consult with the Director of Security for final sign-off.
• Type: Hiring & Firing (within function)
• Entry: N/A
• Mid: N/A
• Senior: Full authority for roles within your team, in consultation with HR and the Director of Security for senior hires.
• Type: Vendor Selection (within function)
• Entry: N/A
• Mid: N/A
• Senior: Full authority up to £100K. For larger contracts, you'll lead the selection process and get approval from the Director of Security.
• Type: Incident Response (major incidents)
• Entry: N/A
• Mid: N/A
• Senior: Lead the response efforts, make critical containment decisions, and communicate updates to executive leadership. You'll inform the Director of Security, but you're running the show.

Competency Requirements

Foundation Skills (Transferable)

Beyond the technical wizardry, a Global Head of Security Manager needs a solid bedrock of leadership and interpersonal skills. You're leading people, influencing decisions, and navigating complex organisational landscapes. These are the skills that make you an effective leader, not just a smart technologist.

• Category: Leadership & People Management
• Skills: Coaching & Mentoring: Helping your team grow, identifying their strengths, and guiding their career paths.
• Performance Management: Setting clear expectations, providing constructive feedback, and addressing underperformance fairly.
• Team Building: Fostering a collaborative, inclusive, and high-trust environment where people feel safe to speak up and innovate.
• Delegation: Effectively assigning tasks and responsibilities, empowering your team, and trusting them to deliver.
• Category: Strategic Communication & Influence
• Skills: Executive Presence: Confidently presenting complex ideas and risks to senior leadership and the board, tailoring your message to their perspective.
• Negotiation & Persuasion: Getting buy-in from reluctant stakeholders, negotiating resources, and advocating for security initiatives across the organisation.
• Cross-functional Collaboration: Working effectively with other department heads (Engineering, Product, Legal, HR) to embed security into their processes.
• Crisis Communication: Clearly and calmly communicating during a security incident, both internally and potentially externally, managing expectations and maintaining trust.
• Category: Problem Solving & Decision Making
• Skills: Strategic Thinking: Translating high-level business objectives into actionable security strategies and programmes.
• Risk-Based Decision Making: Prioritising security investments and initiatives based on a clear understanding of business risk and impact.
• Complex Problem Resolution: Tackling ambiguous, multi-faceted security challenges where there's no obvious answer, often under pressure.
• Resource Optimisation: Making the most of limited budget and personnel to achieve maximum security impact.
• Category: Organisational Acumen
• Skills: Business Acumen: Understanding the company's products, markets, and financial drivers, and how security supports them.
• Organisational Design: Structuring your team and processes for maximum effectiveness and scalability.
• Change Management: Leading your team and the broader organisation through significant security-related changes and transformations.
• Vendor Management: Building and maintaining strong relationships with key security vendors, negotiating contracts, and ensuring service delivery.

Functional Skills (Role-Specific Technical)

You'll need a deep understanding of core security principles and how to apply them at an enterprise level. This isn't about being the best coder, but about knowing how to build, manage, and mature a security programme.

Technical Competencies

• Skill: NIST Cybersecurity Framework (CSF)
• Desc: Deep expertise in implementing and maturing a security programme across the five core functions: Identify, Protect, Detect, Respond, and Recover. You'll use this as a strategic roadmap for your function.
• Level: Expert
• Skill: ISO 27001/27002
• Desc: Practical experience building, managing, and certifying an Information Security Management System (ISMS), especially for global compliance and customer assurance. You'll own the certification process for your domain.
• Level: Expert
• Skill: Threat-Informed Defence (MITRE ATT&CK)
• Desc: Moving beyond compliance checklists to architecting security controls based on real-world adversary tactics, techniques, and procedures (TTPs). You'll guide your team in using this to prioritise defences.
• Level: Advanced
• Skill: Zero Trust Architecture (ZTA)
• Desc: Strategic understanding and practical application of ZTA principles ('never trust, always verify') across identity, endpoints, and networks. You'll be driving the adoption and implementation of this philosophy.
• Level: Advanced
• Skill: Cyber Risk Quantification (CRQ)
• Desc: Using frameworks like FAIR (Factor Analysis of Information Risk) to translate technical vulnerabilities and threats into financial terms (e.g., Annualised Loss Expectancy) for executive and board-level discussions. This is crucial for budget justification.
• Level: Advanced
• Skill: Incident Response Lifecycle (PICERL)
• Desc: Mastery of the formal IR process: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. You'll be able to lead a 'war room' during a crisis and ensure effective post-incident analysis.
• Level: Expert

Digital Tools

• Tool: Splunk Enterprise Security / Microsoft Sentinel
• Level: Strategic
• Usage: Evaluating platform ROI, making procurement decisions, interpreting executive dashboards for business risk, and ensuring the SOC team is getting maximum value.
• Tool: CrowdStrike Falcon / SentinelOne / Wiz / Palo Alto Prisma Cloud
• Level: Strategic
• Usage: Assessing platform effectiveness via MITRE ATT&CK evaluations, managing vendor relationships, presenting cloud risk posture to the CTO, and guiding endpoint/cloud security strategy.
• Tool: ServiceNow GRC / OneTrust / Archer GRC Suite
• Level: Architect
• Usage: Owning the GRC platform strategy, using it for enterprise risk reporting, presenting findings to the board's audit committee, and ensuring it meets compliance needs.
• Tool: Recorded Future / Mandiant Advantage / Anomali
• Level: Strategic
• Usage: Briefing executives on industry-specific threats and geopolitical risk, using intel to shape security strategy and investment, and guiding the threat intelligence team.
• Tool: Tenable.io / Qualys / Rapid7 InsightVM
• Level: Strategic
• Usage: Setting enterprise-wide remediation SLAs, reporting on vulnerability risk trends to leadership, and ensuring the vulnerability management programme is effective.
• Tool: Diligent / Nasdaq Boardvantage / Custom PowerPoint/Tableau
• Level: Architect
• Usage: Designing and presenting the entire security section of the board deck, defending strategy and budget under scrutiny, and ensuring clear, impactful reporting.
• Tool: Confluence / Jira / Slack
• Level: Strategic
• Usage: Reviewing programme-level Kanban boards, communicating major incidents to executive stakeholders, and ensuring effective collaboration and documentation across your teams.

Industry Knowledge

• Area: Regulatory Landscape
• Desc: Deep understanding of key global and regional data protection regulations (e.g., GDPR, CCPA) and industry-specific compliance requirements (e.g., PCI DSS, HIPAA if applicable). You'll need to know how these impact our security strategy.
• Area: Threat Landscape & Attack Vectors
• Desc: A current and comprehensive understanding of common and emerging cyber threats, attack methodologies, and adversary tactics. You'll use this to anticipate risks and guide defensive strategies.
• Area: Cloud Security Best Practices
• Desc: Expert knowledge of security architectures and controls for major cloud providers (e.g., AWS, Azure, GCP), including identity management, network security, data protection, and serverless security.

Regulatory Compliance Regulations

• Reg: GDPR (General Data Protection Regulation)
• Usage: Ensuring our security controls and incident response processes meet GDPR requirements for data protection, breach notification, and data subject rights across all global operations. You'll be accountable for compliance in your domain.
• Reg: ISO 27001/27002
• Usage: Leading the implementation and maintenance of our Information Security Management System (ISMS) within your function, ensuring we achieve and maintain certification. You'll be the go-to person for audit readiness.
• Reg: SOC 2 Type II
• Usage: Overseeing the collection of evidence and control effectiveness for SOC 2 audits, ensuring our security practices meet the Trust Service Criteria. This is key for customer assurance.

Essential Prerequisites

• Proven experience (at least 5 years) leading and managing security teams or functions, with direct reports.
• Demonstrable experience owning significant security programmes from strategy through to execution.
• A track record of managing budgets (ideally £500K+) and making data-driven investment decisions.
• Experience presenting complex security topics and risks to senior executive leadership or board committees.
• A deep understanding of at least two major security domains (e.g., SOC, GRC, Cloud Security, Application Security).
• Experience with formal risk management frameworks (e.g., NIST RMF, ISO 31000) and applying them in practice.

Career Pathway Context

We're looking for someone who isn't new to leadership. You've likely come from a Principal Security Architect role, a Senior Security Engineer who's stepped up to lead, or a similar Security Manager position in another organisation. You'll have seen what good looks like and, frankly, what bad looks like too. This role isn't about learning to lead; it's about leading at a higher strategic level.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: AI Governance & Ethical AI Security
• Why: As we increasingly use AI in our products and operations, securing these systems and ensuring their ethical use becomes paramount. Bad AI can be a massive security risk, and regulators are starting to pay attention. You'll need to define how we secure AI.
• Concepts: [{'concept_name': 'AI model security (e.g., adversarial attacks, data', 'description': 'AI model security (e.g., adversarial attacks, data poisoning)'}, {'concept_name': 'Data privacy in AI (e.g., differential privacy, fe', 'description': 'Data privacy in AI (e.g., differential privacy, federated learning)'}, {'concept_name': 'Ethical AI frameworks and bias detection', 'description': 'Ethical AI frameworks and bias detection'}, {'concept_name': 'Regulatory compliance for AI systems (e.g., EU AI ', 'description': 'Regulatory compliance for AI systems (e.g., EU AI Act)'}, {'concept_name': 'Supply chain security for AI models and components', 'description': 'Supply chain security for AI models and components'}]
• Prepare: This quarter: Read up on the EU AI Act and its implications for security.
• Next 6 months: Attend a workshop or online course on AI/ML security principles.
• Next 12 months: Work with Product and Legal to draft an internal AI security policy.
• Ongoing: Engage with industry groups focused on AI security and ethics.
• QuickWin: Start by identifying where AI is currently used or planned in our products and operations, and initiate a basic risk assessment today.
• Skill: Advanced Cyber Risk Quantification (CRQ) & Financial Modelling
• Why: The board and C-suite are increasingly demanding security presented in financial terms, not just technical jargon. You need to be able to speak their language and show the monetary impact of security decisions. This moves beyond basic FAIR to integrate with broader enterprise risk management.
• Concepts: [{'concept_name': 'Integrating CRQ with enterprise risk management (E', 'description': 'Integrating CRQ with enterprise risk management (ERM) frameworks'}, {'concept_name': 'Advanced financial modelling for cyber risk scenar', 'description': 'Advanced financial modelling for cyber risk scenarios (e.g., Monte Carlo simulations)'}, {'concept_name': 'Communicating Annualised Loss Expectancy (ALE) and', 'description': 'Communicating Annualised Loss Expectancy (ALE) and Return on Security Investment (ROSI)'}, {'concept_name': 'Quantifying intangible losses (reputation, custome', 'description': 'Quantifying intangible losses (reputation, customer trust)'}, {'concept_name': 'Benchmarking risk against industry peers', 'description': 'Benchmarking risk against industry peers'}]
• Prepare: This quarter: Deepen your understanding of the FAIR methodology, if not already expert.
• Next 6 months: Explore advanced CRQ tools and methodologies beyond basic spreadsheets.
• Next 12 months: Lead a pilot programme to quantify a major cyber risk in financial terms for a board presentation.
• Ongoing: Collaborate closely with Finance and Risk teams to align on methodologies and reporting.
• QuickWin: Take one 'High' risk from your current register and try to assign a rough financial impact range to it – even if it's just a back-of-the-envelope calculation.

Advancing Technical Skills

• Skill: DevSecOps Integration & Security Automation
• Why: Security needs to be 'baked in' from the start, not bolted on at the end. You'll need to understand how to integrate security into CI/CD pipelines and automate security controls to keep pace with rapid development cycles.
• Concepts: [{'concept_name': 'Shift-left security principles and practices', 'description': 'Shift-left security principles and practices'}, {'concept_name': 'Security as Code (SaC) and policy as code', 'description': 'Security as Code (SaC) and policy as code'}, {'concept_name': 'Container and Kubernetes security best practices', 'description': 'Container and Kubernetes security best practices'}, {'concept_name': 'Serverless security patterns and challenges', 'description': 'Serverless security patterns and challenges'}, {'concept_name': 'Automated security testing (SAST, DAST, SCA) in pi', 'description': 'Automated security testing (SAST, DAST, SCA) in pipelines'}]
• Prepare: This quarter: Work with your AppSec Lead to understand their current DevSecOps challenges.
• Next 6 months: Attend a conference or online course focused on modern cloud-native security.
• Next 12 months: Sponsor and oversee a project to embed a new automated security gate into a critical CI/CD pipeline.
• Ongoing: Stay current with cloud provider security updates and new open-source security tools.
• QuickWin: Identify one manual security check in a development process and brainstorm with your team how it could be automated.

Education Requirements

• Level: Minimum
• Req: A Bachelor's degree in Computer Science, Information Security, or a related technical field.
• Alts: We're pragmatic. If you've got equivalent practical experience (typically 4+ years beyond the minimum for this role) that demonstrates a deep understanding of security principles and leadership, we're all ears. Show us what you've built and led.
• Level: Preferred
• Req: A Master's degree in Cybersecurity, Business Administration (MBA), or a related field.
• Alts: An MBA or similar postgraduate qualification can be really helpful for the strategic and business-focused aspects of this role, but it's not a deal-breaker if you've got the practical experience to back it up.

Experience Requirements

You'll need roughly 12-16 years of progressive experience in information security, with a significant portion (at least 5-8 years) in a leadership or management capacity, overseeing teams and programmes. This isn't your first rodeo leading people. We're looking for someone who has managed multi-million pound security budgets, led large-scale security programmes, and has a proven track record of influencing senior stakeholders. You should have experience owning a security function end-to-end, from strategy definition to operational delivery.

Preferred Certifications

• Cert: CRISC (Certified in Risk and Information Systems Control)
• Prod: ISACA
• Usage: This certification is brilliant for demonstrating expertise in identifying, assessing, and managing enterprise IT risk, which is a huge part of this role.
• Cert: CISA (Certified Information Systems Auditor)
• Prod: ISACA
• Usage: If your function leans heavily into GRC or compliance, having a CISA shows you understand audit processes and controls from both sides, which is incredibly valuable.
• Cert: Cloud Security Certifications (e.g., AWS Certified Security - Specialty, Azure Security Engineer Associate)
• Prod: AWS, Microsoft
• Usage: Given our reliance on cloud platforms, demonstrating expertise in securing cloud environments is a massive plus. It shows you're keeping up with modern architectures.

Recommended Activities

• Regularly attending industry conferences (e.g., RSA, Black Hat, Infosec Europe) to stay current with emerging threats and technologies.
• Participating in security leadership forums or peer groups to share insights and best practices.
• Contributing to open-source security projects or publishing articles on security topics.
• Mentoring junior security professionals, both within and outside our organisation.
• Undertaking continuous learning through online courses or specialised training in areas like AI security, quantum computing, or advanced risk quantification.

Career Progression Pathways

Entry Paths to This Role

• Path: Principal Security Architect (L4)
• Time: 3-5 years as an L4
• Path: Senior Security Engineer / Lead (L3) with Management Aspirations
• Time: 5-8 years as an L3/L4, plus a dedicated management track
• Path: External Hire (from similar Security Manager role)
• Time: Immediate, with 12-16 years total experience

Career Progression From This Role

• Pathway: Director of Security (L6)
• Time: 3-5 years in this L5 role

Long Term Vision Potential Roles

• Title: Global Head of Security / Chief Information Security Officer (CISO) (L7)
• Time: 5-10 years from this role
• Title: Chief Technology Officer (CTO) / Chief Operating Officer (COO)
• Time: 10-15+ years from this role

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.