Information Security Manager

Role Purpose & Context

Role Summary

The Information Security Manager is responsible for building, running, and continuously improving our company's security programmes. You'll lead a team of talented security professionals, making sure they've got what they need to protect our systems and data. Day-to-day, you'll be at the coalface, ensuring our security controls are actually working, responding to incidents, and generally keeping us safe from the bad actors out there. This role sits right at the heart of our technical operations, bridging the gap between deep technical defence and broader business strategy. When you do this well, our systems remain secure, our data stays private, and our customers trust us implicitly. If it's not done well, frankly, we're looking at potential breaches, regulatory fines, and a massive hit to our reputation – which, let's be real, no one wants. The tricky part is constantly adapting to new threats while also making sure security doesn't become a blocker for innovation. The reward, though? Knowing you're protecting the business, building a strong team, and genuinely making a difference in a constantly evolving landscape. You're not just preventing problems; you're enabling the business to grow securely.

Reporting Structure

• Reports to: Director of Information Security
• Direct reports: A team of 3-8 security professionals (Senior Security Analysts/Engineers and Lead Security Engineers) and potentially 1-2 junior managers.
• Matrix relationships: Security Operations Manager, Head of Information Security, Cyber Security Manager,

Key Stakeholders

Internal:

• Director of Information Security
• Chief Technology Officer (CTO)
• Head of Engineering
• Legal and Compliance Teams
• HR Department
• Product Leads
• Finance Leadership

External:

• External Auditors
• Security Vendors and Partners
• Industry Peer Groups
• Regulatory Bodies

Organisational Impact

Scope: This role directly impacts our operational resilience, regulatory compliance, and overall brand reputation. You're responsible for keeping our digital assets safe, which means you directly influence our ability to operate without disruption, avoid hefty fines, and maintain customer trust. Get it right, and the business thrives. Get it wrong, and the consequences can be catastrophic, affecting everything from revenue to employee morale.

Performance Metrics

Quantitative Metrics

1. Metric: Risk Reduction Score
2. Desc: Demonstrate a measurable reduction in the quantified financial risk score across the organisation, often calculated using a framework like FAIR (Factor Analysis of Information Risk).
3. Target: Achieve a 15% reduction in overall quantified financial risk year-over-year.
4. Freq: Quarterly and Annually
5. Example: If our Annualised Loss Expectancy (ALE) for critical assets was £2M at the start of the year, we'd aim to bring that down to £1.7M by year-end through effective control implementation and risk mitigation.
6. Metric: Audit & Compliance Findings
7. Desc: The number and severity of findings from internal and external security audits (e.g., SOC 2, ISO 27001).
8. Target: Achieve zero material findings and reduce the number of minor findings by 25% on major audits.
9. Freq: Per Audit Cycle (typically annually)
10. Example: Successfully pass our annual ISO 27001 audit with no major non-conformities and only 2-3 minor observations, down from 5-6 the previous year.
11. Metric: NIST CSF Maturity Improvement
12. Desc: Improvement in the organisation's overall security programme maturity score as assessed against the NIST Cybersecurity Framework.
13. Target: Increase our overall NIST CSF maturity score from 'Tier 2: Risk Informed' to 'Tier 3: Repeatable' within 18 months.
14. Freq: Bi-annually
15. Example: Move from having ad-hoc processes for incident response to documented, tested playbooks and a clear reporting structure, pushing our 'Respond' function maturity up a tier.
16. Metric: Security Budget Adherence
17. Desc: Manage the security operational and capital budget effectively, staying within allocated funds.
18. Target: Manage the security budget to within 5% of the annual plan, identifying cost efficiencies where possible.
19. Freq: Monthly and Quarterly
20. Example: End the fiscal year having spent £950K of a £1M budget, demonstrating careful resource allocation and cost control without compromising security effectiveness.
21. Metric: Mean Time to Respond (MTTR)
22. Desc: The average time it takes for the team to contain and eradicate a security incident from detection.
23. Target: Reduce MTTR for critical (P1/P2) incidents by 15% quarter-over-quarter.
24. Freq: Monthly
25. Example: If our average MTTR for a P1 incident was 4 hours last quarter, we'd aim to bring that down to 3 hours 24 minutes this quarter through improved automation and team training.

Qualitative Metrics

1. Metric: Team Effectiveness & Morale
2. Desc: How well your team functions, their professional growth, and overall satisfaction.
3. Evidence: Regular 1:1s showing clear development plans, positive feedback in internal engagement surveys, low voluntary attrition rates within the security team, and successful completion of team-led projects. You'll see your team members stepping up and taking initiative, not just waiting for instructions.
4. Metric: Stakeholder Trust & Collaboration
5. Desc: The level of trust and willingness to collaborate shown by other departments (e.g., Engineering, Product, Legal) towards the security team.
6. Evidence: Other teams proactively involving security early in project planning, seeking your advice on new initiatives, positive feedback from cross-functional peers, and security being seen as an enabler rather than a blocker. You'll be invited to the table, not just brought in when there's a problem.
7. Metric: Strategic Influence
8. Desc: Your ability to influence broader business strategy with security considerations, ensuring security is built-in, not bolted on.
9. Evidence: Security considerations being integrated into product roadmaps and architectural decisions from the outset, your recommendations being adopted by senior leadership, and security being a regular topic in executive discussions. Your input isn't just heard; it's acted upon.
10. Metric: Programme Maturity & Documentation
11. Desc: The robustness and clarity of security policies, procedures, and documentation.
12. Evidence: Well-maintained and easily accessible security policies, up-to-date incident response playbooks, clear risk registers, and comprehensive architectural diagrams. Auditors should find our documentation clear and complete, making their job easier.

Primary Traits

• Trait: Pragmatic Scepticism
• Manifestation: You're the kind of person who always asks 'How do we *really* know this is secure?' rather than just taking someone's word for it. You'll challenge vendor claims, dig into log files yourself to verify a control is actually working, and push your team to prove security effectiveness, not just assume it. It's about a healthy dose of doubt, not outright cynicism. You'll look for the edge cases, the overlooked details, and the 'what if' scenarios that others might miss.
• Benefit: Honestly, 'paper security' is a real problem in our industry – where policies and tools exist, but aren't actually effective. This trait prevents us from having a false sense of security. It's the critical difference between having a firewall configured and genuinely knowing its rules are blocking malicious traffic. Without it, we're just hoping for the best, and hope isn't a security strategy.
• Trait: Calm Under Pressure
• Manifestation: When a major security incident hits, your voice stays steady. You follow a methodical process, delegate clearly to your team, and prevent a chaotic situation from spiralling into panic. You can absorb executive anxiety and translate it into calm, decisive action for your team. You're the eye of the storm, providing a steady hand when everyone else is feeling the heat.
• Benefit: Let's be real, panic leads to mistakes, especially during a crisis. In a ransomware event or a major breach, a calm, clear-headed leader can literally mean the difference between a contained incident and a catastrophic business failure. You'll be the emotional anchor for your technical team and for leadership, ensuring we make the right decisions when it matters most.
• Trait: Influential Communicator
• Manifestation: You can explain the business impact of a critical vulnerability to the CFO using clear financial risk terms, not just technical jargon like CVE scores. You're able to persuade a product team to delay a launch to fix a security flaw by framing it as protecting customer trust and avoiding future reputational damage. You can get different teams, like engineering and legal, on the same page about a security requirement, even when they have conflicting priorities. You're a translator, a negotiator, and a storyteller all rolled into one.
• Benefit: Truth is, security is a team sport, and this role simply fails without buy-in from across the organisation. You must be able to translate complex technical jargon into compelling business narratives to secure budget, resources, and crucial cooperation from other departments. If you can't articulate 'why this matters' in a way that resonates with different audiences, you won't get the support you need, and our security posture will suffer.

Supporting Traits

• Trait: Deeply Curious
• Desc: You're innately driven to understand not just how systems work, but, more importantly, how they can be broken. You're always learning, always digging, always asking 'why?' and 'what if?' to stay ahead of the curve.
• Trait: Patiently Tenacious
• Desc: You understand that changing security culture and getting things done in a large organisation is a marathon, not a sprint. You'll persistently follow up on risks and remediation efforts without becoming discouraged by delays or resistance, knowing that consistent effort pays off.
• Trait: Unflinchingly Accountable
• Desc: During a breach investigation or a security failure, you take ownership, focusing squarely on 'what can we learn?' and 'how do we fix this?' rather than pointing fingers or looking for someone to blame. You lead by example, accepting responsibility for the team's outcomes.

Primary Motivators

1. Motivator: Protecting the Organisation
2. Daily: You'll feel a deep sense of satisfaction knowing that the policies you've implemented, the tools you've deployed, and the team you've led have prevented a real-world attack. Every day is a chance to build a stronger defence and safeguard our assets.
3. Motivator: Building and Mentoring a High-Performing Team
4. Daily: You'll get a real buzz from seeing your team members grow, develop new skills, and take on more responsibility. You're motivated by creating a collaborative environment where everyone learns from each other and contributes to a shared mission.
5. Motivator: Solving Complex, Evolving Problems
6. Daily: The ever-changing threat landscape and the challenge of securing complex technical environments will keep you engaged. You thrive on figuring out how to secure new technologies, adapt to new attack vectors, and continuously improve our defences.

Potential Demotivators

Honestly, this role isn't for everyone. If you need things to be perfectly ordered, predictable, or if you expect every single security recommendation to be adopted immediately, you'll probably struggle. You'll spend a lot of time advocating, educating, and sometimes, frankly, battling against inertia. The 'urgent' request that disrupted your Thursday will get deprioritised on Friday because something else came up. You'll build a beautiful security programme that gets watered down because the business moved on, or budget was reallocated. If you need to see every piece of work make it to production exactly as you envisioned, you'll find this tough.

Common Frustrations

1. The 'Department of No' Stigma: Constantly battling the perception that security's only function is to block business initiatives and slow down development, rather than enable secure growth.
2. Budgeting for a Non-Event: The immense difficulty of justifying a multi-million pound budget to prevent a catastrophic event that, thankfully, hasn't happened yet.
3. Shadow IT Ambush: Discovering a business-critical SaaS application, holding sensitive customer data, that was purchased on a credit card by the marketing department without *any* security review.
4. DevSecOps Theatre: Engineering teams claiming to be 'doing DevSecOps' by running a scanner, but then ignoring 90% of the findings to meet release deadlines.
5. Vendor Hype vs. Reality: Wasting weeks on a proof-of-concept for a 'Next-Gen AI' security tool that turns out to be little more than a fancy dashboard on top of basic signature matching.
6. The Inevitable Weekend Call: Knowing that your phone will ring at 2 AM on a Saturday for a critical incident, regardless of your vacation plans or personal life.

What Role Doesn't Offer

1. A purely technical, hands-on coding role – you'll be leading and managing more than building.
2. A static, predictable environment – the threat landscape is constantly changing, meaning your priorities will too.
3. Guaranteed immediate adoption of every security recommendation – you'll need to influence and negotiate.
4. A role where you can avoid difficult conversations with senior stakeholders or other departments.

ADHD Positives

1. The fast-paced, incident-driven nature of security can be incredibly engaging, providing constant novelty and problem-solving opportunities that suit an ADHD brain.
2. Hyperfocus can be a superpower during a critical incident, allowing you to dive deep into logs and threat intelligence to quickly identify solutions.
3. The need for creative, 'outside the box' thinking to anticipate and counter new threats is highly valued.

ADHD Challenges and Accommodations

1. Managing multiple long-term programmes and administrative tasks can be challenging; we can help with structured project management tools and executive assistants for some admin.
2. Maintaining focus during lengthy policy reviews or GRC documentation can be tough; breaking these tasks into smaller, time-boxed sprints can help.
3. We can offer flexible work arrangements to help manage energy levels and provide quiet spaces for focused work when needed.

Dyslexia Positives

1. Strong spatial reasoning and pattern recognition skills, often associated with dyslexia, are invaluable for identifying anomalies in security logs and understanding complex network architectures.
2. Excellent verbal communication skills can be a huge asset when presenting complex security concepts to non-technical audiences or leading incident calls.
3. A holistic, big-picture thinking approach helps in understanding interconnected systems and potential attack paths.

Dyslexia Challenges and Accommodations

1. Extensive documentation, policy writing, and report generation might be slower; we encourage the use of AI writing tools (more on this below) and offer proofreading support.
2. Reading dense technical specifications or legal documents can be tiring; we provide access to text-to-speech software and encourage visual aids where possible.
3. We're happy to discuss any specific software or tools that could aid in reading, writing, or organisation.

Autism Positives

1. A methodical, logical approach to problem-solving is crucial in information security, especially during incident analysis and forensic investigations.
2. An ability to focus deeply on technical details and spot inconsistencies that others might miss is a significant advantage in identifying vulnerabilities.
3. Direct and honest communication, often a trait, is highly valued in a security context where clarity and accuracy are paramount.

Autism Challenges and Accommodations

1. Navigating complex social dynamics and political influencing can be draining; we'll provide clear expectations for stakeholder engagement and support in these interactions.
2. Unexpected changes or urgent incidents can be disruptive; we aim for clear communication about shifting priorities and provide structured playbooks for incident response.
3. We can offer a consistent work environment, clear communication channels, and support for managing sensory input (e.g., noise-cancelling headphones, quiet workspaces).

Key Responsibilities

Experience Levels Responsibilities

1. Level: Information Security Manager (L5)
2. Responsibilities: Set the vision and strategy for specific security programmes (e.g., Vulnerability Management, Cloud Security, Incident Response) aligned with the overall security roadmap and business objectives. You'll be thinking 12-18 months out, not just next week.
3. Build and lead a high-performing security team. This means hiring, mentoring, performance managing, and ensuring your team has the skills and resources they need to excel. You're responsible for their growth and development.
4. Own the budget for your security programmes, typically ranging from £500K to £2M annually. This includes vendor selection, contract negotiation, and making sure we're getting the best value for our security investments.
5. Drive the transformation of our security posture by identifying gaps, proposing solutions, and overseeing their implementation. This isn't just about maintaining; it's about continuous improvement and innovation.
6. Translate complex technical risks into clear, actionable business language for senior leadership and other departments. You'll be presenting to the CTO, Head of Product, and sometimes even the board's audit committee.
7. Manage relationships with key security vendors and external partners, ensuring they deliver on their commitments and provide the support we need. You're the primary contact for these strategic relationships.
8. Lead the response to major security incidents, acting as the incident commander. This means coordinating technical teams, communicating with leadership, and making critical decisions under pressure to minimise impact.
9. Supervision: You'll operate with a high degree of autonomy, managing your programmes and team with quarterly objectives and strategic alignment meetings with the Director of Information Security. Day-to-day, you're self-directed and accountable for your outcomes.
10. Decision: You have full authority for your functional domain: budget allocation up to £1M, hiring and firing decisions within your team, vendor selection up to £250K, and approval of security architecture designs within your programme scope. Any decisions impacting P&L above £1M or requiring significant organisational change will need consultation with the Director of Information Security and potentially the CTO.
11. Success: Success looks like a demonstrable improvement in our security posture, a highly effective and engaged security team, and strong, trusted relationships with internal and external stakeholders. Your programmes will be robust, well-documented, and consistently delivering against their objectives, ultimately reducing our overall business risk.

Decision-Making Authority

• Type: Security Programme Strategy & Roadmap
• Entry: N/A
• Mid: N/A
• Senior: Defines and owns the strategy, consulting with the Director of Information Security for alignment with overall enterprise security vision.
• Type: Budget Allocation (within programme)
• Entry: N/A
• Mid: N/A
• Senior: Full authority for budgets up to £1M; consults Director for anything above that or significant unbudgeted spend.
• Type: Team Hiring & Performance Management
• Entry: N/A
• Mid: N/A
• Senior: Full authority for hiring, performance reviews, and career development within your direct team. Consults HR and Director for complex employee relations issues.
• Type: Vendor Selection & Contract Management
• Entry: N/A
• Mid: N/A
• Senior: Evaluates, selects, and manages security vendors for your programmes (up to £250K contract value). Consults Legal and Procurement for contract finalisation and Director for strategic vendor partnerships.
• Type: Major Incident Response Actions
• Entry: N/A
• Mid: N/A
• Senior: Acts as Incident Commander, making critical decisions on containment, eradication, and recovery. Informs Director and C-suite on status and impact; consults Legal for regulatory reporting decisions.

Competency Requirements

Foundation Skills (Transferable)

Beyond the technical wizardry, a great Information Security Manager needs a solid set of foundational skills. These are the human elements that make the difference between a good manager and a truly exceptional one – especially when you're dealing with high stakes and complex problems.

• Category: Communication & Influence
• Skills: Executive Presentation Skills: You can stand in front of the CTO or even the board and clearly articulate complex security risks and strategies in a way that resonates with them. No jargon, just impact.
• Negotiation & Persuasion: You're adept at getting different departments (e.g., Engineering, Product, Legal) to agree on security requirements, even when their priorities conflict. It's about finding common ground and building consensus.
• Active Listening: You genuinely listen to concerns from your team and other stakeholders, understanding their perspectives before proposing solutions. This builds trust and ensures your solutions are practical.
• Cross-functional Collaboration: You're a natural at working with diverse teams, understanding their challenges, and integrating security into their workflows without being seen as a blocker.
• Category: Problem-Solving & Strategic Thinking
• Skills: Complex Problem Decomposition: You can take a massive, ambiguous security problem (like 'how do we secure our new cloud platform?') and break it down into manageable, actionable components for your team.
• Risk-Based Decision Making: You consistently make decisions by weighing technical risks against business impact, understanding that perfect security is impossible and pragmatic choices are necessary.
• Strategic Planning & Execution: You can develop a multi-year security roadmap, articulate its value, and then execute against it, adapting as the threat landscape or business priorities change.
• Root Cause Analysis: Beyond just fixing a problem, you lead your team to deeply understand *why* an incident occurred or a vulnerability exists, preventing recurrence.
• Category: Leadership & Team Development
• Skills: Mentorship & Coaching: You actively develop your team members, providing clear guidance, constructive feedback, and opportunities for growth. You're invested in their success.
• Performance Management: You set clear expectations, provide regular feedback, and manage performance effectively, celebrating successes and addressing areas for improvement.
• Conflict Resolution: You can mediate disagreements within your team or between your team and other departments, fostering a collaborative and respectful environment.
• Empowerment & Delegation: You trust your team to take ownership, delegating effectively and giving them the autonomy they need to thrive, while still providing support.
• Category: Adaptability & Resilience
• Skills: Change Management: You can lead your team and the organisation through significant security changes (e.g., new tools, processes, or policies), managing resistance and ensuring smooth adoption.
• Stress Management: You maintain composure and effectiveness under high-pressure situations, especially during security incidents, and help your team do the same.
• Continuous Learning: You have a genuine hunger to stay current with the latest threats, technologies, and best practices in information security, and you foster this in your team.
• Pragmatism: You understand that security is about managing risk, not eliminating it entirely. You can make pragmatic decisions that balance security needs with business realities.

Functional Skills (Role-Specific Technical)

This is where your deep security knowledge comes into play. You'll need to be well-versed in the core methodologies and tools that underpin a robust information security programme. We're looking for someone who doesn't just know these concepts but can strategically apply them and lead a team in their implementation.

Technical Competencies

• Skill: Security Framework Adoption & Adaptation
• Desc: Deep expertise in implementing and tailoring industry-standard frameworks like NIST Cybersecurity Framework (CSF), CIS Controls, and ISO 27001/27002 to our organisation's specific context. This isn't just box-ticking; it's about making them work for us and demonstrating continuous improvement.
• Level: Expert
• Skill: Threat-Informed Defence
• Desc: The ability to proactively model threats using frameworks like MITRE ATT&CK, moving beyond reactive alerting. This involves understanding adversary TTPs (Tactics, Techniques, and Procedures) and strategically mapping our controls to specific attack stages, guiding your team's security efforts.
• Level: Expert
• Skill: Quantitative Risk Management
• Desc: Applying models like FAIR (Factor Analysis of Information Risk) to translate abstract cyber risks into clear financial terms (e.g., Annualised Loss Expectancy). This is crucial for enabling better business decisions, justifying budget, and communicating risk to senior leadership.
• Level: Advanced
• Skill: Incident Response Lifecycle Management
• Desc: Mastery of the full PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) lifecycle. This includes leading tabletop exercises, ensuring playbooks are practical and tested, and driving post-incident improvements.
• Level: Expert
• Skill: Zero Trust Architecture
• Desc: A strategic approach to security that assumes no implicit trust. This means designing and implementing systems based on principles of micro-segmentation, strong identity verification, and least-privilege access for every request. You'll lead the charge on making this a reality.
• Level: Advanced
• Skill: Secure SDLC (Software Development Lifecycle)
• Desc: Integrating security into the entire development process. This involves championing practices like threat modelling in the design phase, overseeing SAST/DAST in the build phase, and ensuring dependency scanning (SCA) is robust in CI/CD pipelines. You'll work closely with engineering leadership.
• Level: Advanced

Digital Tools

• Tool: Splunk Enterprise Security / Microsoft Sentinel (SIEM)
• Level: Strategic/Architect
• Usage: Defining the overall log management and data source strategy, evaluating and selecting SIEM platforms, managing vendor relationships, and overseeing the tuning of alert logic to ensure effective threat detection.
• Tool: Tenable.io / Qualys VMDR (Vulnerability Management)
• Level: Strategic/Architect
• Usage: Owning the enterprise vulnerability management programme, setting risk appetite and remediation SLAs, and reporting on the enterprise-wide vulnerability posture to leadership. You'll ensure the programme is effective and integrated.
• Tool: CrowdStrike Falcon / SentinelOne (EDR)
• Level: Strategic/Architect
• Usage: Determining the enterprise endpoint security strategy (e.g., EDR vs. XDR), approving major policy changes, overseeing the deployment and management of the EDR agent fleet, and managing incident response retainers.
• Tool: Wiz / Orca Security (CSPM)
• Level: Strategic/Architect
• Usage: Defining the cloud security architecture and governance framework, making platform decisions, and presenting the overall cloud risk posture to the CTO/CISO. You'll ensure our cloud environments are secure by design.
• Tool: Okta / Azure Active Directory (IAM)
• Level: Strategic/Architect
• Usage: Owning the enterprise identity strategy, including Zero Trust principles, selecting IAM platforms, and governing the overall access control model. You'll ensure our identities are managed securely and efficiently.
• Tool: ServiceNow GRC / OneTrust (GRC & Compliance)
• Level: Strategic/Architect
• Usage: Managing the relationship with internal and external auditors, defining the GRC strategy, and presenting compliance status to the board's audit committee. You'll ensure we meet our regulatory obligations and manage risk effectively.

Industry Knowledge

• Area: Regulatory Landscape
• Desc: Deep understanding of relevant data protection regulations (e.g., GDPR, DPA 2018), industry standards (e.g., PCI DSS if applicable), and how they impact our technical operations and security strategy. You'll guide the team in achieving and maintaining compliance.
• Area: Threat Landscape & Attack Vectors
• Desc: Comprehensive knowledge of current and emerging cyber threats, attack methodologies, and common vulnerabilities. You'll use this to proactively identify risks and inform our defence strategies.
• Area: Security Architecture Principles
• Desc: Expertise in designing secure systems and networks, including principles like defence in depth, least privilege, segmentation, and secure coding practices. You'll oversee the architectural integrity of our security solutions.

Regulatory Compliance Regulations

• Reg: GDPR (General Data Protection Regulation)
• Usage: Ensuring our technical controls and processes meet GDPR requirements for data privacy, breach notification, and data subject rights. You'll advise on the technical implications of data processing activities.
• Reg: ISO 27001/27002
• Usage: Leading the implementation and maintenance of our Information Security Management System (ISMS) in line with ISO 27001. You'll manage the audit process and drive continuous improvement of controls.
• Reg: NIS Regulations (Network and Information Systems Regulations)
• Usage: Understanding and applying the NIS Regulations if our services are classified as Operators of Essential Services (OES) or Digital Service Providers (DSP). You'll ensure our critical infrastructure is resilient and secure.

Essential Prerequisites

• Proven experience (typically 8-12 years) in a Lead Security Engineer or Principal Security Analyst role, demonstrating a strong technical foundation and experience leading complex security projects.
• Demonstrable experience managing small teams or mentoring multiple junior security professionals, with a focus on their development and project delivery.
• A track record of successfully designing and implementing security solutions across various domains (e.g., cloud, endpoint, identity).
• Experience presenting technical security concepts and risks to non-technical audiences, including senior management.
• A deep understanding of at least three major security domains (e.g., Incident Response, Vulnerability Management, Cloud Security).

Career Pathway Context

Think of this as the natural next step from a Lead Security Engineer. You've mastered the technical craft, you've led projects, and now you're ready to step up and own entire programmes, manage people, and influence the broader security strategy. It's about shifting from 'how do we build this securely?' to 'what security capabilities do we need, and how do we get them?'

Qualifications & Credentials

Emerging Foundation Skills

• Skill: AI-Powered Security Operations & Governance
• Why: AI is rapidly changing how we detect, respond to, and prevent attacks. As a manager, you'll need to understand how to effectively integrate AI into your security operations (e.g., AI-driven threat hunting, automated incident response) and, crucially, how to govern the secure and ethical use of AI within the organisation itself. It's a double-edged sword.
• Concepts: [{'concept_name': 'AI for Threat Detection & Response', 'description': 'Understanding how machine learning models can identify anomalies, predict attacks, and automate parts of the incident response lifecycle, and how to evaluate their effectiveness and potential biases.'}, {'concept_name': 'Secure AI Development & Deployment', 'description': 'Knowing the security risks inherent in AI systems (e.g., prompt injection, data poisoning, model evasion) and how to implement controls to secure our own AI initiatives.'}, {'concept_name': 'AI Governance & Policy', 'description': 'Developing policies and frameworks for the responsible and secure use of AI tools by employees, ensuring compliance and mitigating risks like data leakage or intellectual property theft.'}, {'concept_name': 'Explainable AI (XAI) in Security', 'description': "Understanding how to interpret and validate AI decisions in security tools, especially when they flag critical incidents, to avoid 'black box' reliance."}]
• Prepare: This month: Experiment with AI-powered security tools (e.g., for log analysis, threat intelligence summarisation) in a sandbox environment.
• Next quarter: Lead a tabletop exercise focused on an AI-driven attack scenario or an incident caused by misuse of internal AI tools.
• Within 6 months: Develop a draft 'Acceptable Use of AI' policy for the organisation, collaborating with Legal and HR.
• Within 12 months: Evaluate and propose an AI-driven enhancement to one of your existing security programmes (e.g., vulnerability prioritisation).
• QuickWin: Start using generative AI tools (like ChatGPT or Claude) to draft security awareness content, policy summaries, or even initial incident reports. It's a low-risk way to get comfortable with the tech.
• Skill: Supply Chain Security Governance
• Why: The SolarWinds attack showed us that you're only as strong as your weakest link, and often that's in your supply chain. As we rely more on third-party software, cloud providers, and managed services, managing the security risk from these external dependencies becomes absolutely critical. You'll need to build robust processes to vet and monitor our suppliers.
• Concepts: [{'concept_name': 'Software Bill of Materials (SBOM)', 'description': 'Understanding and requiring SBOMs from vendors to gain visibility into the components (and their vulnerabilities) within third-party software.'}, {'concept_name': 'Third-Party Risk Management (TPRM)', 'description': 'Developing and overseeing processes for assessing, monitoring, and mitigating security risks posed by third-party vendors and suppliers.'}, {'concept_name': 'Vendor Security Audits', 'description': 'Leading or overseeing security assessments and audits of critical suppliers to verify their security controls and compliance.'}, {'concept_name': 'Contractual Security Clauses', 'description': 'Working with Legal to ensure robust security clauses are included in all vendor contracts, covering data protection, incident response, and audit rights.'}]
• Prepare: This month: Review our current top 5 critical vendors. What are their security postures? Where are the gaps?
• Next quarter: Develop a standardised security questionnaire and assessment process for new critical vendors.
• Within 6 months: Implement a process to request and review SBOMs for new software components or critical third-party applications.
• Within 12 months: Lead an initiative to formalise our third-party risk management programme, including regular reviews and reporting.
• QuickWin: Identify our top 3 most critical third-party software providers. Schedule a call with them to discuss their recent security reports (e.g., SOC 2, ISO 27001) and ask about their supply chain security practices.

Advancing Technical Skills

• Skill: Advanced Cloud Security Architecture & Governance
• Why: As our cloud footprint grows and becomes more complex, you'll need to move beyond basic CSPM to architecting truly secure, multi-cloud environments. This includes understanding advanced networking, serverless security, and containerisation security at a strategic level, guiding your team to implement robust controls.
• Concepts: [{'concept_name': 'Cloud Native Security Controls', 'description': 'Deep understanding of security features and best practices within AWS, Azure, and GCP, including identity, networking, data protection, and serverless security.'}, {'concept_name': 'Container & Kubernetes Security', 'description': 'Strategic oversight of securing containerised applications and orchestrators, including image scanning, runtime protection, and network policies.'}, {'concept_name': 'Infrastructure as Code (IaC) Security', 'description': 'Ensuring security is embedded into IaC templates (e.g., Terraform, CloudFormation) to prevent misconfigurations from the outset.'}, {'concept_name': 'Cloud Security Posture Management (CSPM) Optimisation', 'description': 'Strategically using CSPM tools to not just identify, but also automate remediation of cloud misconfigurations at scale.'}]
• Prepare: This month: Review our current cloud architecture diagrams. Identify the top 3 security risks and propose strategic mitigations.
• Next quarter: Lead a project to implement a new cloud security control or optimise an existing one, focusing on automation.
• Within 6 months: Get certified in a cloud security specialisation (e.g., AWS Certified Security - Specialty, Azure Security Engineer Associate).
• Within 12 months: Develop a multi-year cloud security roadmap that addresses emerging threats and new cloud services.
• QuickWin: Work with a Lead Security Engineer to review the security configuration of our most critical cloud-native application. Look for opportunities to implement automated checks.
• Skill: Security Data Science & Analytics
• Why: Moving beyond simple dashboards, you'll need to guide your team in using advanced analytical techniques to extract deeper insights from security data. This means understanding how to apply statistical methods and potentially machine learning to identify complex attack patterns, predict incidents, and measure control effectiveness more accurately.
• Concepts: [{'concept_name': 'Statistical Anomaly Detection', 'description': 'Understanding how to use statistical methods to identify unusual patterns in logs and network traffic that could indicate a security incident.'}, {'concept_name': 'Data Visualisation for Security', 'description': 'Leading the development of clear, impactful dashboards and reports that communicate security posture and incident trends to diverse audiences.'}, {'concept_name': 'Security Metric Development', 'description': 'Defining and tracking meaningful security metrics that accurately reflect risk reduction and programme effectiveness, moving beyond vanity metrics.'}, {'concept_name': 'Basic Machine Learning for Security', 'description': 'Understanding the fundamentals of ML algorithms (e.g., clustering, classification) and how they can be applied to security problems like malware detection or user behaviour analytics.'}]
• Prepare: This month: Identify one key security metric that we currently struggle to measure accurately. Brainstorm how we could improve its measurement.
• Next quarter: Take an online course on data analytics or data science fundamentals, focusing on statistical methods.
• Within 6 months: Lead a project to build an improved security dashboard that provides actionable insights for your team and leadership.
• Within 12 months: Explore how we could use a simple ML model to enhance threat detection or vulnerability prioritisation within one of your programmes.
• QuickWin: Review your current security reports. Can you simplify them? Add more visual elements? What's the one key takeaway you want stakeholders to remember?

Education Requirements

• Level: Minimum
• Req: A Bachelor's degree in Computer Science, Information Security, Engineering, or a closely related technical field.
• Alts: We're pragmatic here. If you've got equivalent practical experience (typically 12+ years in progressive security roles) and a proven track record, we're definitely interested. We value what you can *do* over just where you went to university.
• Level: Preferred
• Req: A Master's degree in Information Security, Cyber Security, or a relevant MBA.
• Alts: While a Master's is a nice-to-have, demonstrable leadership experience and advanced certifications (like CISSP-ISSMP or CISM) often carry just as much weight, if not more.

Experience Requirements

You'll need roughly 12-16 years of progressive experience in information security, with at least 3-5 years in a leadership or managerial capacity where you were responsible for a team and specific security programmes. This isn't your first rodeo; you've seen a few incidents, managed a few projects, and you're ready to step up and own a significant part of our security defence.

Preferred Certifications

• Cert: CRISC (Certified in Risk and Information Systems Control)
• Prod: ISACA
• Usage: Shows strong capability in identifying, assessing, and managing IT risk, which is crucial for this managerial role.
• Cert: CCSP (Certified Cloud Security Professional)
• Prod: ISC2
• Usage: Demonstrates expertise in cloud security architecture and operations, which is increasingly vital for our technical estate.
• Cert: PMP (Project Management Professional)
• Prod: PMI
• Usage: While not security-specific, this shows you can effectively manage complex projects and programmes, which is a big part of this role.

Recommended Activities

• Regularly attend industry conferences (e.g., RSA Conference, Black Hat Europe, Infosec Europe) to stay abreast of the latest threats and technologies.
• Participate in local security meetups or online forums to network and share knowledge with peers.
• Contribute to open-source security projects or publish articles on security best practices.
• Undertake leadership and management training courses to hone your team-building and strategic capabilities.
• Engage in tabletop exercises and incident response simulations to keep your crisis management skills sharp.

Career Progression Pathways

Entry Paths to This Role

• Path: Lead Security Engineer / Principal Analyst (L4)
• Time: 3-5 years in a lead role
• Path: Senior Security Consultant (External)
• Time: 5-8 years in consulting
• Path: Security Architect (L4)
• Time: 3-5 years in an architecture role

Career Progression From This Role

• Pathway: Director of Information Security (L6)
• Time: 3-5 years
• Pathway: Head of GRC (Governance, Risk, and Compliance)
• Time: 3-5 years

Long Term Vision Potential Roles

• Title: Chief Information Security Officer (CISO) (L7)
• Time: 5-10 years
• Title: Chief Risk Officer (CRO)
• Time: 8-12 years
• Title: Security Evangelist / Industry Thought Leader
• Time: 10+ years

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.