International ISO 27001 Information Security Manager

Role Purpose & Context

Role Summary

The International ISO 27001 Information Security Manager is here to make sure our information security controls are actually working and that we're ready for audits, always. You'll take ownership of specific parts of our Information Security Management System (ISMS), which means you're responsible for keeping those particular areas compliant and secure. This directly impacts our ability to win new clients, protect our reputation, and avoid hefty fines. Day-to-day, you'll be the one checking that our policies aren't just words on paper, but real actions people take. You'll work closely with various teams, translating complex ISO requirements into practical steps for them. When you do this well, we pass our audits smoothly, our customers trust us more, and our data stays safe. If things go wrong, we could face compliance failures, reputational damage, and even lose business. The tricky part is getting busy people across the business to prioritise security tasks when they have their own deadlines. The reward, though, is knowing you're a key part of keeping the company secure and building a robust, credible security posture that genuinely protects us.

Reporting Structure

• Reports to: Senior International ISO 27001 Information Security Manager
• Direct reports:
• Matrix relationships: Information Security Compliance Specialist, ISO 27001 Specialist, Security Governance Analyst,

Key Stakeholders

Internal:

• IT Operations team (for technical controls)
• HR team (for security awareness and onboarding/offboarding)
• Legal & Data Protection team (for policy alignment)
• Product Development teams (for secure development practices)
• Sales team (for client security questionnaires)

External:

• External ISO 27001 auditors
• Clients (during security due diligence)

Organisational Impact

Scope: This role is crucial for maintaining our ISO 27001 certification, which is often a non-negotiable requirement for many of our larger clients. You'll directly contribute to reducing our information security risk, protecting sensitive company and customer data, and upholding our reputation as a trustworthy partner. Get this right, and you help us grow. Get it wrong, and we could lose business or face regulatory action.

Performance Metrics

Quantitative Metrics

1. Metric: Control Evidence Documentation Accuracy
2. Desc: The percentage of control evidence items you're responsible for that are accurately documented and readily available.
3. Target: 98%+
4. Freq: Monthly, reviewed pre-audit
5. Example: If you're responsible for 50 pieces of evidence, you'll need 49 or more to be perfectly in order. A missing screenshot or an outdated log would count against this.
6. Metric: Assigned Evidence Request Completion Rate
7. Desc: The percentage of evidence requests assigned to you that are completed by their internal deadline.
8. Target: 100%
9. Freq: Weekly, reviewed pre-audit
10. Example: If the Senior Manager asks for 10 specific logs by Friday, you'll need to deliver all 10 on time. No excuses, really.
11. Metric: Low-Priority Finding Closure Time
12. Desc: The average time it takes you to close out low-priority non-conformities or observations identified during internal audits.
13. Target: < 5 business days
14. Freq: Quarterly
15. Example: An internal audit finds a minor documentation error. You'd be expected to correct it and get it signed off within five working days, typically.
16. Metric: Security Awareness Training Completion Rate
17. Desc: The percentage of employees completing mandatory security awareness training modules you've helped coordinate.
18. Target: 95%+
19. Freq: Quarterly
20. Example: If 200 employees need to complete a module, you'll aim for at least 190 to have finished it by the deadline. This means chasing people, honestly.

Qualitative Metrics

1. Metric: Proactive Control Monitoring
2. Desc: You're not just reacting to issues; you're actively looking for potential control weaknesses before they become problems.
3. Evidence: You'll be bringing up potential issues in team meetings, suggesting improvements to existing controls, and flagging risks that haven't been formally identified yet. It's about spotting the cracks before they become chasms.
4. Metric: Stakeholder Engagement & Education
5. Desc: How effectively you work with other teams to help them understand and implement security requirements, without just dictating to them.
6. Evidence: Other department leads will tell your manager that you're helpful and clear, not just a 'compliance cop'. You'll get invited to their team meetings to explain things, and people will come to you with questions before problems arise. It's about being a trusted advisor, not just an enforcer.
7. Metric: Quality of Audit Preparedness
8. Desc: The overall readiness of your assigned control areas for both internal and external audits.
9. Evidence: When an auditor asks for evidence in your area, you'll have it ready, organised, and accurate, usually without a last-minute scramble. Your Senior Manager won't need to double-check your work constantly, and you'll be able to confidently speak to your controls during an audit.
10. Metric: Contribution to ISMS Improvement
11. Desc: Your ideas and efforts in making our Information Security Management System better, more efficient, or more robust.
12. Evidence: You'll be proposing specific changes to policies or procedures, suggesting new ways to collect evidence, or identifying areas where we can automate some of the more tedious compliance tasks. It's about making things smoother for everyone, not just maintaining the status quo.

Primary Traits

• Trait: Meticulously Process-Minded
• Manifestation: You're the kind of person who reads the instructions, then reads them again. You'll make sure every document has the right version number, every control has its evidence linked, and every step in a procedure is followed to the letter. If there's a checklist, you'll use it, and you'll probably improve it. You genuinely enjoy the satisfaction of a perfectly organised folder or a fully updated risk register.
• Benefit: Honestly, ISO 27001 is all about having a system and sticking to it. Auditors aren't looking for perfection, but they absolutely expect consistency. If you say you do something, you'd better be able to prove you do it the same way every time. A single deviation can lead to a non-conformity, and that just creates more work for everyone. Your meticulousness is our first line of defence against audit findings.
• Trait: Pragmatically Diplomatic
• Manifestation: You can explain why a security control is important to someone who just wants to get their project launched, without sounding like a broken record. You know how to frame a security requirement not as a 'blocker' but as something that helps the business avoid a much bigger problem down the line – like a data breach or a lost client. You'll listen to other teams' concerns and try to find a solution that works for everyone, rather than just saying 'no'.
• Benefit: Truth is, you don't have direct authority over most of the people you'll need to work with. Getting things done means building relationships and persuading people. If you come across as just enforcing rules, you'll get resistance. If you can show them how security helps *them*, you'll get cooperation. It's a fine line between being firm on security and being flexible on implementation, and you'll need to walk it well.
• Trait: Patiently Tenacious
• Manifestation: You're the person who will send the fifth polite follow-up email for that overdue piece of evidence, and it'll sound just as professional as the first. You won't get flustered when a key stakeholder misses a meeting or ignores your request for a week. You'll just keep at it, methodically, until you get what you need. You understand that compliance is a marathon, not a sprint, and sometimes it's just about outlasting people.
• Benefit: Let's be real, everyone's busy. Your requests for evidence or updates might not be at the top of their priority list. If you give up after one or two tries, we'll fail our audits. You need to be persistent, but in a way that doesn't annoy people. It's about being a polite but firm reminder, consistently, until the job is done. This tenacity is what ensures we actually collect all the necessary proof.

Supporting Traits

• Trait: Naturally Sceptical
• Desc: You don't just take 'yes, we do that' as an answer. You'll ask for the screenshot, the log, the meeting minutes, or the signed document. You're always looking for the proof, not just the assertion.
• Trait: Highly Articulate
• Desc: You can explain a complex ISO control requirement in plain English to an IT technician, then rephrase it for a non-technical department head, making sure both understand what's needed.
• Trait: Calm Under Pressure
• Desc: When an external auditor asks a tricky question or uncovers something unexpected, you'll remain composed, think clearly, and respond thoughtfully, rather than panicking. It's about keeping a cool head when things get a bit heated.
• Trait: Inquisitive
• Desc: You genuinely want to understand how different parts of the business actually work, not just what the process document says. This helps you spot risks and suggest controls that fit our real-world operations.

Primary Motivators

1. Motivator: The Satisfaction of Order and Structure
2. Daily: You'll enjoy the process of organising evidence, updating registers, and seeing a control move from 'open' to 'closed'. There's a real joy for you in a well-structured document or a clean audit trail.
3. Motivator: Being a Protector and Enabler
4. Daily: You're motivated by the idea that your work genuinely protects the company from cyber threats and compliance failures, allowing the business to operate securely and confidently.
5. Motivator: Continuous Improvement and Learning
6. Daily: You're keen to find better ways of doing things, whether it's optimising an evidence collection process or learning about the latest ISO 27001 updates. You want to make the ISMS better, not just maintain it.

Potential Demotivators

Honestly, this role isn't for everyone. You'll spend a fair bit of time chasing people for things they've forgotten, explaining the same concept multiple times, and dealing with the perception that you're just there to slow things down. If you need constant visible impact or get easily frustrated by bureaucracy, you might struggle here.

Common Frustrations

1. The 'Compliance Cop' Stereotype: Constantly battling the idea that you're just a bureaucratic obstacle, rather than a partner.
2. Chasing Evidence: Spending a significant chunk of time reminding busy colleagues to provide evidence for controls they implemented ages ago.
3. The 'Paper ISMS': Discovering that a beautifully written policy has little connection to what people actually do day-to-day.
4. Audit Subjectivity: An auditor sometimes focusing on a minor, low-risk issue while overlooking a more significant systemic risk you've been trying to get resources for.
5. The Annual Panic Cycle: Watching security practices get a bit lax for 11 months, followed by a frantic, high-stress scramble in the month before the surveillance audit.

What Role Doesn't Offer

1. High-level strategic decision-making (that's more for Senior or Lead roles).
2. Constant greenfield project work (much of this is about maintaining and improving existing systems).
3. Direct people management responsibilities (you'll guide, but not manage, others).
4. A quiet, solitary work environment (you'll be interacting with lots of different people).

ADHD Positives

1. The varied nature of tasks, from evidence gathering to stakeholder discussions, can keep things interesting and prevent monotony.
2. The need for quick problem-solving during internal audits can be engaging and stimulating.
3. The focus on continuous improvement means there are always new challenges to tackle and processes to refine.

ADHD Challenges and Accommodations

1. The meticulous documentation and repetitive evidence collection can be challenging; using tools with automated reminders and structured templates can help.
2. Staying focused on long, detailed policy reviews might require breaking tasks into smaller chunks or using focus techniques.
3. We can offer flexible work arrangements, noise-cancelling headphones, and visual aids for tracking progress to help manage distractions and maintain focus.

Dyslexia Positives

1. The role requires strong conceptual understanding of security frameworks, which can be a strength for dyslexic thinkers.
2. Problem-solving and identifying patterns in compliance gaps can be areas where a different perspective shines.
3. Verbal communication and explaining complex ideas simply are key, and often strengths for dyslexic individuals.

Dyslexia Challenges and Accommodations

1. Extensive reading and writing of policies, procedures, and audit reports can be demanding; we encourage the use of text-to-speech software and provide templates.
2. Proofreading detailed documentation is critical; we can support with dedicated proofreading tools or peer review processes.
3. We offer flexible document formats, ample time for written tasks, and encourage verbal communication where appropriate to minimise barriers.

Autism Positives

1. The clear, structured nature of ISO 27001 and its processes can be very appealing and provide a sense of predictability.
2. A strong focus on logic, detail, and adherence to rules is essential, aligning well with autistic strengths.
3. The ability to dive deep into specific controls and master technical details is highly valued.

Autism Challenges and Accommodations

1. Navigating complex social dynamics with various stakeholders and managing unexpected changes can be challenging; clear communication protocols and predictable meeting structures help.
2. Interpreting unwritten social rules or subtle cues during discussions might be difficult; we encourage direct, explicit communication.
3. We can provide a quiet workspace, clear expectations for social interactions, and allow for written communication over verbal where preferred to support comfort and effectiveness.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Mid-Level Professional (2-5 years)
2. Responsibilities: Take ownership of a specific set of Annex A controls (e.g., A.5 Information Security Policies, A.9 Access Control, A.11 Physical Security). This means you're the go-to person for those controls, making sure they're implemented and working.
3. Independently gather and document evidence for your assigned controls, making sure it's accurate, up-to-date, and readily available for audits. This usually involves chasing people, honestly.
4. Help conduct internal audits by following established checklists and procedures, identifying minor non-conformities or areas for improvement. You'll be looking for where we're not quite hitting the mark.
5. Manage the Corrective and Preventive Action (CAPA) process for minor findings, tracking progress and making sure actions are completed on time. This is about fixing things and making sure they don't happen again.
6. Support the Senior Manager in managing external ISO 27001 audits, which means you'll be presenting evidence for your controls and answering auditor questions directly.
7. Deliver security awareness training sessions to new starters and existing teams, making sure everyone understands their role in keeping our information secure. You'll need to make it engaging, not just a lecture.
8. Maintain and update ISMS documentation, like policies, procedures, and the Statement of Applicability (SoA), under the guidance of the Senior Manager. Yes, it's tedious, but absolutely essential.
9. Supervision: You'll have weekly check-ins with your Senior Manager to discuss progress, challenges, and priorities. For routine tasks, you'll work independently, but for anything new or complex, you'll consult your manager. We trust you to get on with things, but we're always there if you get stuck.
10. Decision: You can make routine operational decisions within your assigned control areas, like how best to collect a specific piece of evidence or how to track a minor CAPA. Any changes to policies, procedures, or significant deviations from the ISMS require approval from your Senior Manager. You'll recommend solutions for identified issues but won't approve major changes or budget spend.
11. Success: You'll know you're doing well when your assigned control areas are consistently audit-ready, you're proactively identifying improvements, and other teams see you as a helpful resource for security questions. Basically, you're making your Senior Manager's life easier by owning your patch.

Decision-Making Authority

• Type: Control Implementation Method
• Entry: Follows documented steps; escalates any deviation or uncertainty to supervisor.
• Mid: Chooses the most efficient method for evidence collection and control operation within existing guidelines; consults Senior Manager for new approaches or significant changes.
• Senior: Designs and approves new control implementation methods; defines guidelines for junior staff.
• Type: Non-Conformity (NC) Closure
• Entry: Documents findings and proposed actions; supervisor approves and assigns tasks.
• Mid: Investigates minor NCs, proposes corrective actions, and tracks their completion; escalates major NCs or complex root causes to Senior Manager.
• Senior: Approves CAPA plans for significant NCs; reviews root cause analyses; signs off on closure for all findings.
• Type: ISMS Documentation Updates
• Entry: Updates existing templates with new information under direct supervision.
• Mid: Drafts minor updates to policies or procedures based on operational changes or audit findings; requires Senior Manager review and approval.
• Senior: Designs new documentation templates; approves significant policy changes; maintains the overall integrity and structure of the ISMS documentation.
• Type: Stakeholder Communication
• Entry: Responds to direct requests from supervisor; communicates status updates to immediate team.
• Mid: Communicates directly with functional teams regarding control requirements and evidence requests; escalates difficult conversations or resistance to Senior Manager.
• Senior: Leads discussions with department heads on security compliance; represents the ISMS team in cross-functional project meetings.

Competency Requirements

Foundation Skills (Transferable)

Beyond the technical know-how, we're looking for someone who can genuinely operate within a team, solve problems, and communicate effectively. These are the bedrock skills that let you apply your security knowledge in a real-world setting.

• Category: Communication & Collaboration
• Skills: Clear Written Communication: Drafting concise emails, audit reports, and policy updates that are easy to understand for various audiences.
• Verbal Explanations: Articulating complex security concepts and requirements simply to non-technical colleagues, both one-on-one and in small groups.
• Active Listening: Genuinely understanding stakeholder concerns and feedback, rather than just waiting to speak.
• Teamwork: Working effectively with your Senior Manager and other departments to achieve shared compliance goals, even when priorities clash.
• Category: Problem-Solving & Analytical Thinking
• Skills: Root Cause Analysis: Investigating why a non-conformity occurred and identifying the underlying issues, not just the symptoms.
• Information Gathering: Knowing what questions to ask and where to look for relevant evidence and data.
• Risk Identification: Spotting potential security weaknesses or compliance gaps in processes or systems.
• Structured Thinking: Breaking down complex compliance problems into manageable steps and developing logical solutions.
• Category: Organisation & Attention to Detail
• Skills: Task Prioritisation: Managing multiple evidence requests and CAPA actions, knowing what needs to be done first.
• Documentation Management: Keeping all ISMS records, evidence, and reports meticulously organised and version-controlled.
• Accuracy: Ensuring all data, reports, and communications are free from errors, especially when dealing with audit evidence.
• Process Adherence: Consistently following established procedures and guidelines for ISMS management.
• Category: Adaptability & Initiative
• Skills: Learning Agility: Quickly picking up new security concepts, tools, or regulatory updates.
• Proactive Approach: Identifying potential issues or improvements without being asked and taking initial steps to address them.
• Managing Ambiguity: Being comfortable when not all information is immediately available and knowing when to ask for clarification.
• Resilience: Staying focused and positive even when faced with resistance or setbacks from busy colleagues.

Functional Skills (Role-Specific Technical)

These are the specific skills and tools you'll need to hit the ground running in an ISO 27001 compliance role. We're looking for practical experience, not just theoretical knowledge.

Technical Competencies

• Skill: ISO 27001/27002 ISMS Management
• Desc: Practical knowledge of how to establish, implement, maintain, and continually improve an Information Security Management System. This includes understanding the clauses of ISO 27001 and the controls in Annex A.
• Level: Intermediate
• Skill: Risk Assessment & Treatment Methodologies
• Desc: Ability to participate in systematic risk assessments, identify risks, and help develop a Risk Treatment Plan (RTP) that aligns with business objectives. You'll understand concepts like risk appetite and residual risk.
• Level: Intermediate
• Skill: Internal & External Audit Management
• Desc: Experience in preparing for and supporting internal and external certification/surveillance audits. This means you know how to gather evidence, respond to auditor questions, and track findings.
• Level: Intermediate
• Skill: Corrective & Preventive Action (CAPA) Process
• Desc: Understanding and application of a formal methodology for investigating root causes of non-conformities and implementing actions to prevent recurrence. You'll be managing these for minor issues.
• Level: Intermediate
• Skill: Security Awareness & Training Program Development
• Desc: Ability to deliver existing security awareness training programmes and contribute ideas for improvement. You'll understand why it's important to change behaviour, not just tick a box.
• Level: Intermediate

Digital Tools

• Tool: GRC Platforms (e.g., ServiceNow GRC, OneTrust, Archer, Vanta)
• Level: Intermediate
• Usage: You'll be regularly entering data into risk registers, tracking controls, pulling pre-defined reports, and managing assigned tasks within our chosen GRC platform. You should be comfortable navigating it and understanding its structure.
• Tool: Audit & Project Management (e.g., Jira, Confluence)
• Level: Intermediate
• Usage: You'll create tickets for non-conformities, attach evidence to Confluence pages, and update project statuses for audit-related tasks. You'll know how to manage your own workflow within these tools.
• Tool: Collaboration Suite (e.g., MS Teams, SharePoint)
• Level: Intermediate
• Usage: You'll manage dedicated channels or teams for specific audit activities, use SharePoint for evidence collection and document versioning, and generally use these tools for daily communication and file sharing.
• Tool: Executive Reporting (e.g., PowerPoint, Power BI)
• Level: Basic
• Usage: You'll populate data into existing PowerPoint templates for management reviews and use basic Power BI dashboards to extract information about control performance or audit findings. You won't be building them from scratch, but you'll use them effectively.

Industry Knowledge

• Area: Information Security Principles
• Desc: A solid grasp of core information security principles like confidentiality, integrity, and availability, and how they apply in a business context.
• Area: Common Cyber Threats
• Desc: Understanding of common cyber threats (e.g., phishing, malware, ransomware) and basic defence mechanisms.
• Area: Data Protection Regulations
• Desc: Basic awareness of key data protection regulations like GDPR and how they intersect with ISO 27001 requirements.

Regulatory Compliance Regulations

• Reg: ISO/IEC 27001:2022 (and 27002)
• Usage: You'll have a practical working knowledge of the standard's clauses and Annex A controls, understanding how to apply them in our organisation. You'll be able to explain specific requirements and their implications for different teams.
• Reg: General Data Protection Regulation (GDPR)
• Usage: You'll understand the basic principles of GDPR and how ISO 27001 controls can help us meet our data protection obligations, especially regarding data security and breach notification. You won't be a GDPR expert, but you'll know enough to spot overlaps.

Essential Prerequisites

• At least 2-3 years of hands-on experience in an information security or compliance role, specifically dealing with ISO 27001.
• Demonstrable experience in gathering and documenting evidence for security controls.
• Experience participating in or supporting internal and external audits.
• A clear understanding of the ISO 27001 framework, including the Statement of Applicability (SoA) and Annex A controls.
• Proven ability to communicate effectively with technical and non-technical teams.
• Strong organisational skills and a keen eye for detail – you'll need to show us you can keep things tidy.

Career Pathway Context

We're not expecting you to be an ISO 27001 guru yet, but you should have a solid foundation. This role is about taking that existing knowledge and applying it more independently, owning specific parts of the ISMS, and growing your expertise. If you've been an 'analyst' or 'coordinator' in a similar field, this could be your next step.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: AI-Assisted Compliance & Auditing
• Why: AI tools are getting smarter at automating repetitive compliance tasks, from evidence collection to initial gap analysis. Those who can effectively use these tools will be significantly more productive and valuable.
• Concepts: [{'concept_name': 'Prompt Engineering for Compliance', 'description': 'Learning how to write effective prompts for Large Language Models (LLMs) to generate policy drafts, summarise audit findings, or identify control gaps.'}, {'concept_name': 'Automated Evidence Scripting', 'description': 'Understanding how to use simple scripts or AI agents to pull evidence from systems like cloud platforms, Jira, or GitHub automatically.'}, {'concept_name': 'AI Output Validation', 'description': "Developing critical thinking to validate AI-generated content for accuracy and relevance, as AI can 'hallucinate' or provide incorrect information."}, {'concept_name': 'Ethical AI Use in Compliance', 'description': 'Understanding the ethical implications and biases of using AI in compliance, particularly around data privacy and fairness.'}]
• Prepare: This month: Start experimenting with public LLMs (ChatGPT, Claude) to draft emails, summarise documents, or brainstorm policy ideas.
• Next quarter: Look for webinars or online courses on 'AI for GRC' or 'Prompt Engineering for Business'.
• Month 3-6: Identify one recurring, manual task in your current role that could potentially be automated or assisted by AI, and research tools that could help.
• Month 6-12: Propose a small pilot project to your Senior Manager to test an AI tool for a specific compliance task.
• QuickWin: Start using AI to draft your routine emails or summarise long documents today. It's low-risk and gives immediate time savings.

Advancing Technical Skills

• Skill: Cloud Security Controls (AWS/Azure/GCP)
• Why: More and more of our infrastructure and data are moving to the cloud. You'll need to understand how ISO 27001 controls translate into cloud environments and how to gather evidence from these platforms.
• Concepts: [{'concept_name': 'Shared Responsibility Model', 'description': 'Understanding what security responsibilities lie with the cloud provider versus with us.'}, {'concept_name': 'Cloud Identity & Access Management (IAM)', 'description': 'How user access is managed and controlled in cloud environments.'}, {'concept_name': 'Cloud Security Posture Management (CSPM)', 'description': 'Tools and techniques for continuously monitoring cloud configurations for compliance and security issues.'}, {'concept_name': 'Cloud Logging & Monitoring', 'description': 'How to access and interpret logs and audit trails from cloud services for evidence collection.'}]
• Prepare: This month: Look for free introductory courses on AWS, Azure, or GCP fundamentals, focusing on security modules.
• Next quarter: Shadow a cloud engineer or architect to understand how they implement security controls.
• Month 3-6: Read up on specific cloud security best practices (e.g., CIS Benchmarks for cloud).
• Month 6-12: Volunteer to take ownership of a cloud-related Annex A control and learn how to gather its evidence directly from the cloud console.
• QuickWin: Familiarise yourself with the basic navigation of our primary cloud provider's console. Just poke around and see what's there (without making any changes, obviously!).

Education Requirements

• Level: Minimum
• Req: A-Levels or equivalent vocational qualification (e.g., BTEC Level 3/4) in a relevant subject like IT, Business, or a related field.
• Alts: We're open to candidates who can demonstrate equivalent practical experience (typically 4+ years) in an information security or compliance role, even without formal qualifications. Show us what you can do, not just what certificates you have.
• Level: Preferred
• Req: A Bachelor's degree (or equivalent OFQUAL Level 6) in Information Security, Computer Science, Business Management, or a related discipline.
• Alts: Relevant industry certifications (like ISO 27001 Lead Implementer/Auditor) combined with extensive practical experience can often substitute for a degree.

Experience Requirements

You'll need at least 2-5 years of dedicated experience in an information security or compliance role, with a significant focus on ISO 27001. This isn't an entry-level position; we're looking for someone who has already been hands-on with control management, evidence gathering, and supporting audits. Experience in a regulated industry or a fast-paced tech environment would be a bonus.

Preferred Certifications

• Cert: ISO 27001 Lead Implementer
• Prod: Various (e.g., PECB, BSI)
• Usage: This shows a deeper understanding of how to establish and maintain an ISMS, which is highly relevant to this role's responsibilities.
• Cert: ISO 27001 Lead Auditor
• Prod: Various (e.g., PECB, BSI)
• Usage: This certification demonstrates a strong grasp of auditing principles and how to identify non-conformities, which is crucial for internal audit activities and managing external audits.
• Cert: CompTIA Security+
• Prod: CompTIA
• Usage: While not ISO-specific, this shows a solid foundational knowledge of general cybersecurity concepts and best practices, which underpins all information security roles.

Recommended Activities

• Regularly reading industry publications and blogs on information security and compliance trends (e.g., ISACA Journal, SANS Institute).
• Attending webinars or online workshops focused on ISO 27001 updates or specific control implementations.
• Participating in local information security meetups or professional networking groups to share knowledge and learn from peers.
• Taking on stretch assignments within the team to gain exposure to different aspects of the ISMS or other compliance frameworks.

Career Progression Pathways

Entry Paths to This Role

• Path: Information Security Analyst (Entry Level)
• Time: 2-3 years
• Path: IT Auditor / Junior Compliance Officer
• Time: 2-4 years
• Path: IT Support / Operations Specialist with Security Focus
• Time: 3-5 years

Career Progression From This Role

• Pathway: Senior International ISO 27001 Information Security Manager
• Time: 3-5 years
• Pathway: Information Security Risk Analyst
• Time: 3-5 years

Long Term Vision Potential Roles

• Title: Lead ISO 27001 Auditor / ISMS Manager (Level 4)
• Time: 5-8 years from current role
• Title: Information Security & Compliance Manager (Level 5)
• Time: 8-12 years from current role
• Title: Director of Governance, Risk & Compliance (GRC) (Level 6)
• Time: 12-16 years from current role

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.