International ISO 27001 Information Security Director Manager

Role Purpose & Context

Role Summary

The International ISO 27001 Information Security Director Manager is here to own and drive our ISO 27001 compliance strategy and operations for a major business unit or geographical region. You'll lead a team of security professionals, making sure our Information Security Management System (ISMS) isn't just certified, but actually works, protecting our data and systems globally. This role sits right at the heart of our risk management efforts, translating complex security requirements into practical, business-aligned solutions. When you do this well, we'll maintain our international certifications with zero major non-conformities, our enterprise risk score will drop, and our business units will trust security as a partner, not a blocker. If it's not done right, we're looking at failed audits, potential regulatory fines, reputational damage, and, frankly, a lot of sleepless nights. The challenge? Balancing strict compliance with the fast pace of business, often with legacy systems and diverse international requirements. The reward? Knowing you're directly responsible for protecting our entire organisation from significant threats, building a high-performing team, and shaping our global security culture.

Reporting Structure

• Reports to: Director, International Information Security
• Direct reports: Roughly 10-25 security professionals, including other managers
• Matrix relationships: Senior Manager, Global Information Security, Head of ISO 27001 Compliance, Principal Information Security Lead,

Key Stakeholders

Internal:

• SVP of relevant Business Unit/Region
• Executive peers in Product, Engineering, Legal, and HR
• Internal Audit Committee
• Risk Management Committee

External:

• External ISO 27001 Certification Bodies
• Key Vendors and Third-Party Partners
• Industry Regulators (e.g., ICO, BaFin)
• Major Clients during security reviews

Organisational Impact

Scope: This role directly shapes the information security posture and compliance standing of a significant portion of our global operations. You'll be accountable for maintaining critical certifications, reducing enterprise-level risks, and building a security-aware culture that protects our assets, reputation, and customer trust. Honestly, your decisions here can directly affect our ability to operate in certain markets and win major client contracts.

Performance Metrics

Quantitative Metrics

1. Metric: ISO 27001 Certification Status
2. Desc: Achieving and maintaining ISO 27001 certification across all designated international scopes with minimal issues.
3. Target: Zero Major Non-conformities annually; less than 3 Minor Non-conformities per audit cycle.
4. Freq: Annually (during external audits) and continuously (via internal audits).
5. Example: Successfully passed the annual ISO 27001 surveillance audit for the EMEA region with no Major NCs and only one Minor NC, which was remediated within 30 days.
6. Metric: Enterprise Risk Reduction Score
7. Desc: The measurable reduction in our overall information security risk score for your business unit/region, as defined by our internal risk framework.
8. Target: 10% reduction in overall enterprise risk score year-over-year.
9. Freq: Quarterly (via risk register reviews) and Annually (formal assessment).
10. Example: Reduced the aggregate risk score for the APAC business unit by 12% in Q4 by implementing new cloud security controls and improving third-party risk management.
11. Metric: Security Budget Adherence
12. Desc: Managing the allocated security budget effectively, ensuring critical initiatives are funded without overspending.
13. Target: Within ±5% of the approved annual budget for your functional area.
14. Freq: Monthly (budget review) and Quarterly (forecasts).
15. Example: Managed the security operations budget of £1.2M for the year, coming in at £1.18M, while delivering all key security projects on time.
16. Metric: Control Effectiveness & Maturity
17. Desc: The measured effectiveness and maturity of key security controls within your scope, often assessed against frameworks like NIST CSF or CIS Controls.
18. Target: Increase average control maturity score by 0.5 points (on a 1-5 scale) annually.
19. Freq: Bi-annually (internal assessments) and Annually (external audits).
20. Example: Improved the maturity of our incident response control from 'Defined' to 'Managed' by implementing a new SOAR platform and conducting regular tabletop exercises.

Qualitative Metrics

1. Metric: Executive & Stakeholder Trust
2. Desc: How much confidence senior leadership and business unit heads have in your team's ability to manage information security risks and support business objectives.
3. Evidence: You'll know you're doing well when senior leaders proactively involve you in strategic planning discussions, seek your counsel on new business initiatives, and openly support your security recommendations. They won't just see you as a 'no' person, but as a trusted advisor. This also means receiving positive feedback from internal audit and external certification bodies on your programme's robustness.
4. Metric: Team Leadership & Development
5. Desc: Your ability to build, mentor, and retain a high-performing team of security professionals, fostering a culture of continuous improvement and accountability.
6. Evidence: This looks like low team turnover, positive feedback in 360-degree reviews, and a clear progression path for your direct reports. You'll see your team members taking on more responsibility, growing their skills, and contributing innovative ideas. Frankly, they'll be proud to work for you, and that's a huge indicator of success.
7. Metric: Proactive Risk Identification & Mitigation
8. Desc: Your team's ability to identify emerging security risks before they become incidents and implement effective mitigation strategies.
9. Evidence: We'll see this in your regular risk committee reports, where you're not just reacting to issues but presenting forward-looking threat intelligence and proposing preventative measures. It also means fewer surprises—no 'shadow IT' popping up that you weren't aware of, and a clear understanding of our threat landscape. You're anticipating problems, not just fixing them.
10. Metric: Cross-Functional Collaboration & Influence
11. Desc: How effectively you work with other departments (e.g., Product, Engineering, Legal) to embed security into their processes and gain their buy-in.
12. Evidence: Success here means security requirements are integrated early into product development cycles, engineering teams see security as a shared responsibility, and legal teams involve you in contract negotiations. You're not just sending out policies; you're building relationships that make security a natural part of everyone's job. This is about being seen as an enabler, not just a gatekeeper.

Primary Traits

• Trait: Influential Leader
• Manifestation: You're the person who can get a busy Engineering Lead to prioritise a critical security patch over a new feature, not by demanding it, but by clearly explaining the business risk. You'll articulate the financial impact of a potential breach to the CFO in terms they understand, securing that much-needed budget. You're constantly building bridges, creating a network of 'security champions' in other departments who advocate for your team's goals. Honestly, you're a bit of a diplomat, but with a clear agenda.
• Benefit: Security often feels like a cost centre or a blocker to innovation. Without genuine influence, your policies will be ignored, your budget requests will be denied, and you'll be fighting a constant uphill battle for resources and buy-in. At this level, it's not about telling people what to do; it's about inspiring them to do the right thing for security.
• Trait: Decisive Accountability
• Manifestation: When a major incident hits, you're the one making the clear 'go/no-go' call on whether to take a system offline, even with incomplete information. You'll authorise emergency changes during a crisis, knowing the buck stops with you. You're comfortable accepting a calculated risk, but only after it's thoroughly documented and justified, ready to defend that decision to the board. You don't shy away from owning the outcome, good or bad.
• Benefit: In a security crisis, analysis paralysis is fatal. You must be able to weigh the evidence quickly, consider the broader business context, and make a defensible decision under immense pressure. Leadership and auditors need to see that you take absolute ownership, not just assign tasks. Trust is built on accountability, especially when things go wrong.
• Trait: Strategic Pragmatism
• Manifestation: You understand that perfect security is a myth and that every control has a cost. You'll focus your team's efforts on reducing the most significant risks, not chasing every minor vulnerability. This means you're willing to accept a documented, residual risk if the cost of mitigation outweighs the benefit, and you can explain why. You're always looking for the most effective, rather than the most technically pure, solution, especially when dealing with legacy systems or tight budgets.
• Benefit: At this level, you're managing significant resources (people, budget, technology). If you're not pragmatic, you'll burn out your team, waste money on low-impact activities, and alienate business partners who see security as an impossible ideal. It's about smart risk management, not just risk elimination.

Supporting Traits

• Trait: Diplomatic Communicator
• Desc: You can deliver bad news—like a failed audit finding or a necessary system lockdown—without alienating the team or leadership. You're skilled at translating complex technical jargon into clear, actionable business language for executive audiences, and you're equally adept at listening to and understanding concerns from all levels.
• Trait: Resilient Under Pressure
• Desc: Security incidents, audit failures, budget cuts, and political setbacks are all part of the job. You'll need to bounce back quickly, maintaining your focus on the long-term strategy and keeping your team motivated, even when things feel tough. It's about learning from mistakes and moving forward, not dwelling on them.
• Trait: Meticulous Governance
• Desc: While pragmatic, you still possess a deep-seated need to see documentation, evidence, and configurations align perfectly, especially when an external auditor is watching. You understand that the details matter for compliance and that sloppy work can lead to major non-conformities. This isn't just about 'checking boxes'; it's about proving due diligence.

Primary Motivators

1. Motivator: Driving Organisational Impact
2. Daily: You'll get a real kick out of seeing your team's work directly protect the company, whether it's preventing a breach, securing a new client contract because of our strong compliance, or improving our overall risk posture. You're motivated by tangible results that safeguard the business.
3. Motivator: Building & Mentoring High-Performing Teams
4. Daily: You enjoy developing people, seeing your team members grow, and creating a collaborative environment where everyone feels empowered to contribute to security. You'll spend significant time coaching, guiding, and removing roadblocks for your managers and individual contributors.
5. Motivator: Solving Complex, Multi-faceted Problems
6. Daily: You're energised by the challenge of figuring out how to secure a new, complex cloud architecture, or how to harmonise security controls across multiple international entities with different regulatory landscapes. These aren't simple problems, and that's precisely what excites you.

Potential Demotivators

Honestly, this isn't a role for someone who needs constant, immediate gratification or who struggles with ambiguity. You'll spend a fair bit of time in meetings, often discussing things that feel abstract until a crisis hits. You'll inherit legacy systems that are a nightmare to secure and even harder to get budget to fix. You'll also have to deal with the 'GRC Tax' – the constant operational overhead of compliance and evidence-gathering that can feel like it's taking away from 'real' security work. If you need to see every piece of work make it to production or get a clear 'win' every week, you'll struggle here.

Common Frustrations

1. The 'Security vs. Speed' Battle: Constantly negotiating with Product and Engineering teams who see security controls as a bottleneck to innovation and feature delivery, rather than an enabler.
2. Budgeting for a 'Non-Event': Trying to secure a seven-figure budget to prevent something (a breach) that hasn't happened yet, making ROI calculations feel abstract and hard to justify to the CFO.
3. Shadow IT Liability: Being held responsible for securing applications and data stores that you only discover after they've been deployed by business units without your knowledge, creating massive blind spots.
4. Translating Technical Risk to Business Impact: The constant challenge of explaining why a 'CVSS 9.8 vulnerability in a Log4j library' is a business-critical threat to an executive who just wants to know if the quarterly numbers are at risk.
5. Audit Fatigue: Your team (and other business units) will experience exhaustion from a constant stream of audits from clients, regulators, and internal teams, often asking for the same evidence in slightly different formats.

What Role Doesn't Offer

1. A purely technical, hands-on coding role – you'll be leading and strategising more than doing deep technical work.
2. A 'set it and forget it' environment – security is constantly evolving, and so will your programme.
3. An escape from bureaucracy – managing compliance at this scale involves a fair amount of process and documentation.
4. Freedom from difficult conversations – you'll often be the bearer of bad news or the enforcer of unpopular policies.

ADHD Positives

1. The fast-paced, crisis-driven nature of security can be highly engaging, providing the novelty and urgency that can help with focus.
2. The need for innovative problem-solving and 'thinking outside the box' (in a good way!) to address complex security challenges can be a strength.
3. Leading multiple workstreams and managing diverse projects can provide variety and prevent boredom, which is often helpful.

ADHD Challenges and Accommodations

1. The extensive documentation, policy writing, and meticulous audit evidence collection might be challenging; we can support with tools for structured note-taking and dedicated time blocks for deep work.
2. Maintaining focus during long, strategic meetings can be tough; we encourage short breaks, active participation, and providing agendas with clear objectives beforehand.
3. Managing a large team requires consistent follow-ups and administrative tasks; we can offer executive assistant support for scheduling and task tracking, and encourage the use of project management tools.

Dyslexia Positives

1. Strong conceptual thinking and ability to see the 'big picture' of security architecture and risk management, often a strength for dyslexic individuals.
2. Excellent verbal communication skills, especially in explaining complex security concepts to non-technical stakeholders, can shine.
3. Problem-solving through creative and non-linear approaches is highly valued in incident response and strategic planning.

Dyslexia Challenges and Accommodations

1. Extensive reading and writing of policies, reports, and audit responses can be demanding; we use screen readers, dictation software, and offer proofreading support for critical documents.
2. Attention to detail in written documentation (e.g., SoA, risk registers) is crucial; we encourage the use of grammar and spell-checking tools and provide templates with clear structures.
3. Presentations to the board require clear, concise written materials; we can provide design support and focus on visual aids to complement verbal delivery.

Autism Positives

1. A deep, focused expertise in ISO 27001, security frameworks, and technical controls can be a significant asset, leading to unparalleled mastery.
2. A preference for logical, structured processes and adherence to standards (like ISO 27001) is a natural fit for compliance management.
3. Direct, honest communication, especially in conveying security risks, can be highly effective with senior leadership when framed appropriately.

Autism Challenges and Accommodations

1. Navigating complex organisational politics and unspoken social cues in stakeholder negotiations can be tricky; we offer mentoring on navigating corporate dynamics and clear communication guidelines.
2. The need for adaptability in a constantly evolving threat landscape and shifting priorities might be challenging; we provide clear strategic direction and structured frameworks for decision-making.
3. Extensive networking and informal social interactions can be draining; we support focused, agenda-driven meetings and provide quiet spaces for concentration.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Principal/Manager (12-16 years)
2. Responsibilities: Set the strategic vision and roadmap for ISO 27001 compliance and information security for a major business unit or geographical region. This isn't just about maintaining; it's about evolving and improving our posture.
3. Own the P&L (profit and loss) for your security function, typically managing a budget between £500K and £2M. You'll justify investments, manage costs, and ensure efficient use of resources.
4. Build, lead, and mentor a high-performing team of 10-25 security professionals, including other managers. This means hiring, developing talent, setting clear objectives, and fostering a culture of accountability and continuous improvement.
5. Define and manage the enterprise information security risk register for your scope, translating technical risks into clear business impacts for executive peers and the Director, International Information Security.
6. Lead all engagements with external ISO 27001 certification bodies and regulatory auditors. You'll be the primary point of contact, defending our ISMS and negotiating findings.
7. Drive the adoption of security best practices and controls across relevant business functions, often requiring significant influence and collaboration with Product, Engineering, and Legal teams.
8. Make strategic decisions on security tooling, architecture, and control implementation within your domain, ensuring alignment with global security strategy and business needs.
9. Develop and test comprehensive Business Continuity and Disaster Recovery (BCDR) plans, ensuring the business unit can recover from significant disruptive incidents.
10. Supervision: You'll operate with a high degree of autonomy, setting your own priorities and managing your team's workload. Your supervision will primarily involve quarterly objective setting and strategic alignment discussions with the Director, International Information Security. You're expected to be self-directed and proactive.
11. Decision: You'll have full authority for your functional area, including: budget allocation up to £2M, hiring and firing decisions for your team, organisational design within your function, and vendor selection up to £100K. Strategic decisions impacting other departments or requiring significant capital expenditure will need alignment with executive peers or the Director, International Information Security. Board-level decisions require CEO alignment.
12. Success: Success looks like maintaining ISO 27001 certification with zero Major Non-conformities, demonstrably reducing the enterprise risk score for your business unit, and building a highly effective, engaged security team. You'll be seen as a trusted strategic partner by business unit leadership, not just a compliance enforcer. Ultimately, it's about protecting the business and enabling growth securely.

Decision-Making Authority

• Type: Security Tooling & Architecture
• Entry: Recommends specific tools or configurations based on defined requirements, all decisions reviewed by Senior/Lead.
• Mid: Selects and configures tools for specific projects within established architectural guidelines; escalates novel tool choices.
• Senior: Designs and implements new security architectures for workstreams, makes technical tool selections up to £5K budget, consults Lead/Manager on strategic changes.
• Type: Risk Acceptance & Mitigation
• Entry: Identifies and documents risks following templates, proposes standard mitigation actions, requires approval for any risk acceptance.
• Mid: Performs initial risk assessments, proposes mitigation plans, can accept low-severity risks within defined parameters, escalates medium/high risks.
• Senior: Conducts comprehensive risk assessments, designs complex mitigation strategies, can accept medium-severity risks, recommends acceptance of high-severity risks to Lead/Manager.
• Type: Team Management & Development
• Entry: Manages own learning and development, seeks guidance from senior team members.
• Mid: Provides informal guidance to new joiners, identifies personal development goals, seeks training opportunities.
• Senior: Mentors 0-2 junior analysts, conducts performance reviews for mentees, identifies skill gaps and training needs for their project team.
• Type: Budget Allocation
• Entry: No budget authority. Tracks project expenses.
• Mid: Manages project expenses up to £1K, flags potential overspends.
• Senior: Manages workstream budgets up to £5K, makes recommendations for larger expenditures to Lead/Manager.

Competency Requirements

Foundation Skills (Transferable)

At this level, we expect you to have a rock-solid foundation in leadership, strategic thinking, and complex problem-solving. These aren't just buzzwords; they're the bedrock of managing a critical international security function.

• Category: Strategic Leadership & Management
• Skills: Organisational Leadership: Building and motivating diverse teams, fostering a culture of accountability and continuous improvement.
• Change Management: Leading security transformations, overcoming resistance, and embedding new processes effectively across the organisation.
• Strategic Planning: Developing long-term security roadmaps that align with business objectives and anticipate future threats.
• Performance Management: Setting clear KPIs, conducting regular reviews, and driving team performance.
• Category: Executive Communication & Influence
• Skills: Board-Level Presentation: Articulating complex security risks and strategies to non-technical executive and board audiences.
• Negotiation & Persuasion: Gaining buy-in for security initiatives, budgets, and policy changes from senior stakeholders.
• Cross-Functional Collaboration: Building strong relationships and influencing outcomes across departments (e.g., Legal, HR, Product, Engineering).
• Crisis Communication: Managing internal and external communications during security incidents with clarity and composure.
• Category: Complex Problem Solving & Decision Making
• Skills: Analytical Thinking: Breaking down intricate security challenges into manageable components and identifying root causes.
• Risk-Based Decision Making: Making sound judgments under pressure, often with incomplete information, balancing security posture with business continuity.
• Innovation & Adaptability: Identifying and implementing new security approaches and technologies to address evolving threats and business needs.
• Critical Thinking: Evaluating security solutions, vendor proposals, and threat intelligence with a discerning eye.

Functional Skills (Role-Specific Technical)

You'll need deep, demonstrable expertise in information security management systems, risk frameworks, and the practical application of controls. This isn't theoretical; it's about making it work in the real world.

Technical Competencies

• Skill: ISMS Implementation & Management (ISO/IEC 27001)
• Desc: You'll have expert-level knowledge in designing, implementing, operating, monitoring, reviewing, maintaining, and continually improving an Information Security Management System (ISMS) based on ISO 27001. This includes scoping, risk assessment, Statement of Applicability (SoA) development, internal audits, and management reviews. You're not just familiar with it; you've owned it.
• Level: Expert
• Skill: Risk Management Frameworks (NIST RMF, ISO 31000, FAIR)
• Desc: Expert ability to conduct both quantitative (like FAIR) and qualitative risk assessments. You can define and articulate risk appetite, manage a comprehensive risk register, and translate technical risks into clear business impact for executive decision-making. This means you understand how to prioritise and manage risk effectively.
• Level: Expert
• Skill: Control Frameworks & Auditing (COBIT, CIS Controls, SOC 2)
• Desc: Mastery of mapping controls across multiple frameworks to avoid redundant work – the 'audit once, report many' philosophy. You'll have extensive experience managing external audits (ISO 27001, SOC 2, client audits), including negotiating scope, responding to findings, and driving remediation programmes. You know what auditors look for.
• Level: Expert
• Skill: Business Continuity & Disaster Recovery (BCDR)
• Desc: Advanced capability in planning, documenting, and rigorously testing BCDR plans, including leading tabletop exercises and full-scale simulations. You'll ensure the organisation can recover from disruptive incidents within defined RTO/RPO (Recovery Time Objective/Recovery Point Objective) targets.
• Level: Advanced
• Skill: Supply Chain / Third-Party Risk Management (TPRM)
• Desc: Advanced experience in developing and managing comprehensive TPRM programmes. This includes assessing the security posture of critical vendors, conducting contract reviews, using security questionnaires (e.g., SIG, CAIQ), and establishing ongoing monitoring to manage third-party risk effectively.
• Level: Advanced

Digital Tools

• Tool: GRC Platforms (e.g., ServiceNow GRC, OneTrust, Archer)
• Level: Strategic
• Usage: Leading the selection, integration, and strategic use of GRC platforms to model enterprise risk, automate compliance workflows, and report on overall security posture to the board and executive team. You'll ensure the platform provides actionable insights, not just data.
• Tool: Audit Management (e.g., AuditBoard, HighBond, Vanta)
• Level: Strategic
• Usage: Defining the strategy for how audit management platforms are used across the organisation. You'll use platform analytics to identify systemic control weaknesses, optimise the global audit schedule, and drive continuous improvement in our audit readiness and response.
• Tool: Vulnerability Management (e.g., Nessus, Qualys, Tenable.io)
• Level: Strategic
• Usage: Setting the enterprise vulnerability management strategy, defining risk acceptance criteria, and reporting on overall exposure reduction to executives. You'll ensure the programme aligns with business priorities and effectively reduces our attack surface.
• Tool: Cloud Security Posture Management (e.g., Wiz, Palo Alto Prisma Cloud, Orca Security)
• Level: Strategic
• Usage: Owning the cloud security architecture and strategy. You'll justify investment in CSPM tools based on risk reduction in our multi-cloud environments (AWS, Azure, GCP) and ensure these tools integrate effectively into our broader security programme.
• Tool: Executive Reporting (e.g., Power BI, Tableau, Diligent Boards)
• Level: Expert
• Usage: Designing and presenting concise, compelling risk narratives to the Board and executive leadership using tools like Diligent. You'll be expected to defend your metrics under scrutiny and translate complex security data into clear strategic insights.

Industry Knowledge

• Area: International Privacy Regulations (GDPR, CCPA, LGPD, etc.)
• Desc: A deep understanding of the interplay between security controls and international privacy requirements, including data mapping, Data Protection Impact Assessments (DPIAs), and breach notification obligations across different legal jurisdictions. You'll work closely with legal teams on this.
• Area: Threat Landscape & Emerging Technologies
• Desc: Keeping abreast of the latest cyber threats, attack vectors, and security technologies. This includes understanding how new technologies (e.g., AI, quantum computing, blockchain) might impact our security posture and compliance requirements.
• Area: Industry Best Practices & Benchmarking
• Desc: Knowledge of security best practices within our industry and the ability to benchmark our security programme against peers and leading organisations to identify areas for improvement.

Regulatory Compliance Regulations

• Reg: ISO/IEC 27001:2022
• Usage: You'll be the ultimate authority on ISO 27001 within your business unit/region, responsible for its full implementation, maintenance, and continuous improvement. This includes leading certification audits and ensuring ongoing compliance.
• Reg: General Data Protection Regulation (GDPR)
• Usage: Understanding how GDPR impacts our information security controls, data handling practices, and breach notification procedures. You'll work closely with our Data Protection Officer (DPO) and legal teams to ensure security supports privacy compliance.
• Reg: NIST Cybersecurity Framework (CSF)
• Usage: Using the NIST CSF as a complementary framework for assessing and improving our overall cybersecurity posture, particularly in areas like incident response and continuous monitoring. You'll map our controls to NIST to demonstrate comprehensive coverage.
• Reg: Local Data Protection Laws (e.g., UK DPA 2018, CCPA, LGPD)
• Usage: A working knowledge of key local data protection laws relevant to our international operations, ensuring our security controls adequately address regional legal requirements. You'll know when to engage local legal counsel.

Essential Prerequisites

• Proven track record of successfully implementing and managing ISO 27001 certified ISMS in a complex, international organisation.
• Extensive experience (12+ years) in information security, with at least 5 years in a leadership role managing security teams (10+ individuals).
• Demonstrable experience owning and managing significant security budgets (£500K+).
• Strong background in risk management, including conducting enterprise-level risk assessments and defining risk appetite.
• Experience presenting complex security concepts and risks to executive leadership and board-level committees.
• A deep understanding of cloud security principles and controls (AWS, Azure, GCP).

Career Pathway Context

We're looking for someone who has already 'done the hard yards' at the Senior and Lead levels, building and running security programmes. You'll have a clear understanding of what it takes to get an ISO 27001 certification and, more importantly, how to maintain it and make it genuinely effective. This isn't your first rodeo when it comes to managing audits or building a security team.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: AI Governance & Security
• Why: AI is rapidly becoming embedded in every business function, from customer service to product development. This creates new attack surfaces, data privacy concerns, and ethical dilemmas that security leaders must address. If we don't govern AI securely, it becomes a massive risk.
• Concepts: [{'concept_name': 'AI Risk Management Frameworks', 'description': 'Understanding frameworks like NIST AI RMF for identifying, assessing, and mitigating risks associated with AI systems.'}, {'concept_name': 'Data Privacy in AI', 'description': 'Ensuring sensitive data used for AI training and inference adheres to GDPR and other privacy regulations, including anonymisation and synthetic data techniques.'}, {'concept_name': 'AI Model Security', 'description': 'Protecting AI models from adversarial attacks (e.g., data poisoning, model evasion) and ensuring their integrity and explainability.'}, {'concept_name': 'Ethical AI Principles', 'description': 'Integrating ethical considerations into AI development and deployment, ensuring fairness, transparency, and accountability.'}]
• Prepare: This quarter: Read up on NIST AI RMF and understand its core components. Attend a webinar on AI security best practices.
• Next quarter: Work with your Legal and Data Science teams to assess one internal AI project against emerging AI security and privacy guidelines.
• Month 6: Develop a preliminary 'AI Security Policy' for your business unit, outlining acceptable use and risk mitigation strategies.
• Ongoing: Encourage your team to experiment with secure AI tools and share their findings.
• QuickWin: Start by identifying all AI tools currently in use (both official and 'shadow IT') within your business unit. This will give you a baseline of what needs governing.
• Skill: Quantum-Safe Cryptography Strategy
• Why: While still a few years out, quantum computing has the potential to break current encryption standards, rendering much of our existing security infrastructure obsolete. As a leader, you need to start planning for this 'quantum-safe' transition now to avoid a future crisis.
• Concepts: [{'concept_name': 'Post-Quantum Cryptography (PQC)', 'description': 'Understanding the new cryptographic algorithms being developed to resist quantum attacks (e.g., lattice-based, code-based).'}, {'concept_name': 'Cryptographic Agility', 'description': 'Designing systems that can easily swap out cryptographic algorithms as new standards emerge or old ones become vulnerable.'}, {'concept_name': 'Inventory of Cryptographic Assets', 'description': 'Knowing where and how cryptography is used across the organisation to identify critical systems for future migration.'}, {'concept_name': 'Quantum Key Distribution (QKD)', 'description': 'Understanding the principles and potential applications of quantum mechanics for secure key exchange.'}]
• Prepare: This quarter: Read introductory papers on PQC and its implications. Understand the current NIST standardisation process.
• Next quarter: Conduct an initial inventory of critical systems and data that rely heavily on current cryptographic standards within your scope.
• Month 6: Begin discussions with your architecture and engineering teams about 'cryptographic agility' in future system designs.
• Ongoing: Monitor industry developments and vendor roadmaps for quantum-safe solutions.
• QuickWin: Identify your most sensitive, long-lived data that needs protection for decades. This data will be the first priority for quantum-safe migration.

Advancing Technical Skills

• Skill: Security Orchestration, Automation, and Response (SOAR) at Scale
• Why: As threat volumes increase, manual incident response becomes unsustainable. You'll need to drive the strategic implementation of SOAR platforms to automate repetitive tasks, accelerate response times, and free your team for more complex analysis.
• Concepts: [{'concept_name': 'Playbook Development & Optimisation', 'description': 'Designing and refining automated playbooks for common security incidents (e.g., phishing, malware alerts).'}, {'concept_name': 'Integration with Security Tools', 'description': 'Ensuring SOAR platforms seamlessly connect with SIEM, EDR, vulnerability scanners, and other security tools.'}, {'concept_name': 'Metrics for Automation Efficiency', 'description': 'Measuring the impact of automation on MTTR (Mean Time To Respond) and team productivity.'}, {'concept_name': 'Human-in-the-Loop Automation', 'description': 'Designing automation that augments, rather than replaces, human analysts, allowing for critical decision points.'}]
• Prepare: This quarter: Review your current incident response processes and identify 2-3 areas ripe for automation.
• Next quarter: Work with your security operations team to pilot a SOAR playbook for a common alert type.
• Month 6: Evaluate the ROI of the pilot and develop a roadmap for broader SOAR adoption across your business unit.
• Ongoing: Stay updated on SOAR platform capabilities and best practices.
• QuickWin: Automate the initial triage and enrichment of phishing alerts. This is usually low-hanging fruit for SOAR.
• Skill: DevSecOps & Security by Design Governance
• Why: Security can no longer be an afterthought; it must be 'shifted left' into the development lifecycle. Your role is to govern this process, ensuring security is built in from the start, not bolted on at the end.
• Concepts: [{'concept_name': 'Security Champions Programme', 'description': 'Establishing and nurturing a network of developers who act as security advocates within their teams.'}, {'concept_name': 'Automated Security Testing (SAST/DAST/SCA)', 'description': 'Integrating security testing tools into CI/CD pipelines to catch vulnerabilities early and automatically.'}, {'concept_name': 'Threat Modelling & Secure Design Reviews', 'description': 'Ensuring security teams engage with product and engineering early to identify and mitigate design-level risks.'}, {'concept_name': 'Infrastructure as Code (IaC) Security', 'description': 'Implementing security controls and best practices for managing infrastructure through code.'}]
• Prepare: This quarter: Review existing DevSecOps practices within your business unit. Identify key gaps.
• Next quarter: Partner with an Engineering Lead to pilot a 'security by design' review for a new project.
• Month 6: Develop a strategy for scaling DevSecOps practices, including a Security Champions programme.
• Ongoing: Champion security training for developers and provide resources for secure coding.
• QuickWin: Integrate a simple static application security testing (SAST) tool into one development team's pipeline and track early findings.

Education Requirements

• Level: Minimum
• Req: Bachelor's degree in Information Security, Computer Science, Engineering, or a related field.
• Alts: Extensive (15+ years) relevant professional experience in information security leadership, coupled with industry-recognised certifications, can be considered in lieu of a degree.
• Level: Preferred
• Req: Master's degree (MSc) in Cybersecurity, Information Security Management, or a related discipline.
• Alts: N/A

Experience Requirements

You'll need roughly 12-16 years of progressive experience in information security, with a significant portion (at least 5-7 years) in a leadership or management role. This means you've successfully managed teams of 10 or more security professionals, including other managers, and have been directly responsible for the strategic direction and operational performance of an ISO 27001-certified ISMS across a major business unit or region. We're looking for someone who has genuinely owned the outcome, not just contributed to it.

Preferred Certifications

• Cert: CISA (Certified Information Systems Auditor)
• Prod: ISACA
• Usage: Demonstrates a strong understanding of IT audit processes, which is incredibly useful for navigating external audits and building robust internal control frameworks.
• Cert: CRISC (Certified in Risk and Information Systems Control)
• Prod: ISACA
• Usage: Validates your expertise in identifying, assessing, and managing enterprise IT risk, which is a core part of this role's strategic remit.
• Cert: Cloud Security Certifications (e.g., CCSP, AWS/Azure/GCP Security Specialty)
• Prod: ISC2, AWS, Microsoft, Google
• Usage: Given our increasing reliance on cloud infrastructure, demonstrating advanced knowledge of cloud security principles and controls is a significant advantage.

Recommended Activities

• Regularly attend industry conferences (e.g., RSA Conference, Black Hat, Infosecurity Europe) to stay abreast of emerging threats and technologies.
• Participate in professional security forums and communities to share knowledge and build your professional network.
• Engage in continuous learning through online courses or workshops on advanced security topics (e.g., AI security, quantum cryptography).
• Seek out mentorship opportunities from senior security leaders or executive coaches to refine your leadership and strategic influence skills.

Career Progression Pathways

Entry Paths to This Role

• Path: Lead ISO 27001 Auditor / InfoSec Manager (L4)
• Time: 3-5 years in previous role
• Path: Principal Security Architect (L5 equivalent)
• Time: 4-6 years in previous role
• Path: Security Manager from a larger enterprise
• Time: 5-8 years in a similar role at a larger, more complex organisation

Career Progression From This Role

• Pathway: Director, International Information Security (L6)
• Time: 3-5 years in this role

Long Term Vision Potential Roles

• Title: Chief Information Security Officer (CISO) (L7)
• Time: 5-10 years
• Title: Chief Risk Officer (CRO)
• Time: 7-12 years
• Title: Head of Global Compliance & Privacy
• Time: 5-10 years

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.