Senior International ISO 27001 Information Security Director

Role Purpose & Context

Role Summary

The Senior International ISO 27001 Information Security Director is responsible for making sure our global information security system (ISMS) isn't just a tick-box exercise, but genuinely protects our business. You'll lead internal audits, design new security controls, and generally be the person who knows our ISO 27001 certification inside out. This directly impacts our ability to win and keep clients, as well as protecting our reputation and commercial secrets. Day-to-day, you'll be working closely with our IT, Product, and Legal teams, translating complex security requirements into practical actions. You'll help them understand why a certain control matters and how to implement it without slowing them down too much. When you do this job well, we sail through our external ISO 27001 audits, our client security questionnaires are a breeze, and our leadership sleeps a little easier knowing our data is well-protected. If it's not done well, we risk losing certifications, facing regulatory fines, and potentially suffering a data breach that could really hurt the business. The tricky part is often getting everyone on the same page about security priorities, especially when they're busy building new features. The reward, though, is seeing your work directly contribute to the company's integrity and knowing you're protecting something truly valuable.

Reporting Structure

• Reports to: Lead ISO 27001 Auditor / InfoSec Manager
• Direct reports: You won't have direct reports, but you'll mentor 0-2 junior team members.
• Matrix relationships: Senior Information Security Lead, Senior GRC Specialist, ISO 27001 Compliance Lead, Senior Information Security Analyst (Compliance),

Key Stakeholders

Internal:

• IT Operations and Infrastructure Teams
• Product and Engineering Leadership
• Legal and Data Privacy Teams
• Internal Audit Team
• Senior Leadership (for reporting and recommendations)

External:

• External ISO 27001 Auditors (e.g., BSI, LRQA)
• Key Vendors and Third-Party Suppliers
• Clients (during security questionnaire responses)
• Regulatory Bodies (indirectly, through compliance)

Organisational Impact

Scope: You're the engine room for our ISO 27001 compliance. Your work directly underpins our ability to maintain critical certifications, which in turn opens doors to new business and keeps our existing client base happy. Get it right, and you'll significantly reduce our exposure to information security risks, protecting our assets and reputation. Get it wrong, and we could face significant financial penalties, reputational damage, and lost business opportunities.

Performance Metrics

Quantitative Metrics

1. Metric: Internal Audit Non-Conformity Rate
2. Desc: The number of non-conformities (issues) identified during internal ISO 27001 audits.
3. Target: Reduce Major Non-Conformities to 0, Minor Non-Conformities by 20% year-on-year.
4. Freq: Quarterly, post-internal audit.
5. Example: After your Q2 internal audit, you found 2 minor non-conformities, down from 3 in Q1, and zero majors. That's progress.
6. Metric: Control Effectiveness Score
7. Desc: A score reflecting how well our security controls are designed and operating, based on internal assessments.
8. Target: Maintain an average control effectiveness score of 90% across all critical ISO 27001 Annex A controls.
9. Freq: Bi-annually, during control reviews.
10. Example: You've reviewed our access control process (A.9.2.1) and identified improvements that boosted its effectiveness score from 85% to 92%.
11. Metric: Mean Time to Remediate (MTTR) for Audit Findings
12. Desc: The average time it takes to fix issues identified during internal or external audits.
13. Target: Reduce MTTR for critical audit findings to under 45 days.
14. Freq: Monthly, tracked in Jira/GRC platform.
15. Example: An audit finding about unpatched servers (critical) was closed in 38 days, beating the target and showing quick action.
16. Metric: Third-Party Security Assessment Completion Rate
17. Desc: The percentage of critical third-party vendors who have completed our security assessment process.
18. Target: Achieve 95% completion for all new critical vendors within 30 days of onboarding.
19. Freq: Monthly, tracked in GRC platform.
20. Example: You've chased down the last two outstanding security questionnaires, bringing our critical vendor completion rate to 98% for the month.

Qualitative Metrics

1. Metric: Stakeholder Engagement and Trust
2. Desc: How effectively you build relationships and influence teams to adopt security best practices, and how much they trust your advice.
3. Evidence: Teams proactively come to you for security advice before starting new projects. Your recommendations are usually adopted without significant pushback. You're seen as a helpful partner, not just a 'no' person. Feedback from internal clients (e.g., Product, Engineering) indicates you're easy to work with and provide clear guidance.
4. Metric: Quality of ISMS Documentation
5. Desc: The clarity, accuracy, and completeness of our ISO 27001 documentation (policies, procedures, SoA).
6. Evidence: External auditors consistently commend the quality and organisation of our documentation. New team members can easily understand and follow security procedures. Fewer questions arise during internal audits due to unclear documentation. Your Statement of Applicability (SoA) is always up-to-date and reflects our current control environment.
7. Metric: Proactive Risk Identification
8. Desc: Your ability to spot potential security risks before they become incidents or audit findings.
9. Evidence: You regularly bring new, relevant risks to the attention of leadership with proposed mitigations. You identify gaps in our control framework before external parties do. Your input helps us avoid issues that might have otherwise caused problems during audits or incidents.
10. Metric: Mentorship Effectiveness
11. Desc: How well you guide and develop junior team members in their understanding and application of information security principles.
12. Evidence: Junior team members report feeling supported and learning a lot from you. They show noticeable improvement in their work quality and autonomy after working with you. You're consistently providing constructive feedback and helping them navigate complex tasks.

Primary Traits

• Trait: Influential
• Manifestation: You're the person who can get an engineering team to prioritise a security patch over a new feature, not by demanding it, but by explaining the real business impact. You can articulate why a specific risk matters to a non-technical CFO, helping them understand the numbers behind the threat. You're also good at building a network of 'security champions' within other departments, making sure security isn't just your job, but everyone's.
• Benefit: Honestly, security is often seen as a blocker or just another cost. If you can't influence people, your policies will just gather dust, your budget requests will get ignored, and you'll be constantly fighting an uphill battle for resources. Your ability to persuade and build consensus is absolutely vital here.
• Trait: Decisive
• Manifestation: When a new product is about to launch, you're able to make a clear 'go/no-go' call based on any unresolved security risks, even if it's unpopular. During a security incident, you can authorise emergency changes with incomplete information, understanding the trade-offs. You're comfortable accepting a calculated risk, but always with a clear, documented justification.
• Benefit: In a crisis, or even just during a tight deadline, 'analysis paralysis' can be fatal. You need to be able to weigh the evidence quickly, consider the wider business context, and make a defensible decision under pressure. You'll have ultimate accountability for these calls, so a strong, clear head is essential.
• Trait: Accountable
• Manifestation: You take ownership for control failures without trying to blame individuals or other teams. If there's a near-miss, you're proactively reporting it to leadership and explaining what we're doing to prevent it next time. After an audit finding, you're the one creating and driving the remediation plan, not just assigning it out and hoping it gets done.
• Benefit: Trust is your most important currency in this role. When leadership, external auditors, and even your own team see that you take full ownership for both the good and the bad, they'll trust your judgment more. That trust is what gets you support for your initiatives and helps you navigate the tougher conversations.

Supporting Traits

• Trait: Pragmatic
• Desc: You understand that 'perfect security' is a myth and often impossible. Instead, you focus on what actually reduces risk in a practical, achievable way, rather than chasing every theoretical vulnerability.
• Trait: Diplomatic
• Desc: You can deliver bad news – like a failed internal audit finding or an unpopular new policy – without alienating the teams you need to work with. It's about getting the message across effectively, even when it's tough.
• Trait: Resilient
• Desc: Security incidents, audit failures, and political setbacks happen. You're the kind of person who bounces back quickly, learns from it, and maintains focus on the long-term strategy, rather than getting bogged down.
• Trait: Meticulous
• Desc: You have a deep-seated need to see documentation, evidence, and system configurations align perfectly. This is especially true when you know an external auditor will be scrutinising every detail. You catch the small things that others miss.

Primary Motivators

1. Motivator: Protecting the Business
2. Daily: You get a real kick out of knowing your work directly contributes to safeguarding our company's data, reputation, and client trust. It's not just about compliance; it's about genuine security.
3. Motivator: Solving Complex Puzzles
4. Daily: You enjoy the challenge of mapping intricate security requirements to messy real-world systems, finding elegant solutions that balance security with business needs. It's like a constant game of chess.
5. Motivator: Driving Continuous Improvement
6. Daily: You're always looking for ways to make things better, whether it's optimising an audit process, improving a control, or streamlining documentation. Stagnation isn't in your vocabulary.

Potential Demotivators

Honestly, this role isn't for everyone. You'll spend a fair bit of time chasing people for evidence, which can feel like herding cats. You'll sometimes be the bearer of bad news, telling teams they can't do something they really want to, or that they need to re-do work because it doesn't meet security standards. You'll also build beautiful, comprehensive plans that sometimes get deprioritised because something else 'more urgent' comes up. If you need constant visible wins and hate administrative tasks, you might struggle.

Common Frustrations

1. The 'Security vs. Speed' Battle: You'll constantly be negotiating with Product and Engineering teams who see security controls as a bottleneck to innovation and feature delivery. It's a never-ending push and pull.
2. Chasing Evidence: A significant chunk of your time will be spent following up with various teams to get the documentation and proof needed for audits. It's not glamorous, but it's essential.
3. Translating Technical Risk: Explaining why a 'CVSS 9.8 vulnerability in a Log4j library' is a business-critical threat to an executive who just wants to know if the quarterly numbers are at risk can be incredibly frustrating.
4. Audit Fatigue (for others): You'll be asking teams for evidence they've probably already provided for another audit, leading to some eye-rolls and grumbling. You'll have to manage that perception.

What Role Doesn't Offer

1. A quiet, predictable 9-to-5: Security incidents don't stick to office hours, and audit deadlines can be brutal. Expect some late nights and urgent requests.
2. Uninterrupted deep work: You'll be pulled into meetings, asked for quick advice, and constantly interrupted by requests for information. Focus time is something you'll have to fight for.
3. Universal popularity: Sometimes, you'll have to say 'no' or enforce unpopular policies. You won't always be everyone's favourite person, and you'll need to be okay with that.

ADHD Positives

1. The varied nature of tasks, from auditing to control design to incident response, can be engaging and prevent boredom.
2. High-pressure situations, like incident response, can tap into hyperfocus, leading to rapid problem-solving.
3. The need for quick, decisive action in security can be a good fit for those who thrive under urgency.

ADHD Challenges and Accommodations

1. The meticulous documentation requirements for ISO 27001 can be challenging; using structured templates and AI tools for first drafts can help.
2. Managing multiple ongoing audit findings and remediation plans requires strong organisation; visual tracking tools (Jira dashboards, GRC platforms) are key.
3. Frequent interruptions from various stakeholders might break focus; dedicated 'deep work' blocks and clear communication boundaries can be useful.

Dyslexia Positives

1. Strong conceptual thinking and pattern recognition are highly valued in identifying security risks and designing robust controls.
2. Excellent verbal communication skills (often seen in dyslexic individuals) are crucial for influencing stakeholders and explaining complex security concepts.
3. The ability to see the 'big picture' of an ISMS and how different controls fit together can be a significant strength.

Dyslexia Challenges and Accommodations

1. Extensive reading and writing of policies, procedures, and audit reports can be demanding; using text-to-speech software and leveraging AI for summarisation can assist.
2. Proofreading detailed documentation is critical for ISO 27001; pairing with a colleague for reviews or using advanced grammar/spelling checkers is recommended.
3. Structured templates for all documentation (SoA, risk assessments) can reduce cognitive load and ensure consistency.

Autism Positives

1. A strong adherence to rules and logical frameworks (like ISO 27001) is a significant asset in compliance roles.
2. Exceptional attention to detail, especially in identifying discrepancies in evidence or control weaknesses, is highly valued.
3. The preference for clear, direct communication can be effective in security discussions, cutting through ambiguity.

Autism Challenges and Accommodations

1. Navigating complex social dynamics and influencing non-technical stakeholders can be challenging; clear communication guidelines and structured meeting formats can help.
2. Unexpected changes or urgent incidents can be disruptive; clear incident response playbooks and predictable communication channels are important.
3. Sensory overload in open-plan offices or during intense meetings might occur; access to quiet spaces or noise-cancelling headphones can be provided.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Senior Professional (5-8 years)
2. Responsibilities: Lead internal ISO 27001 audits from planning through to reporting, making sure we're always ready for the external auditors. (This means deep dives into processes, interviewing teams, and spotting where we might fall short.)
3. Design and implement new security controls or improve existing ones, translating ISO 27001 requirements into practical, workable solutions for our global operations. (You'll often be the bridge between what the standard says and what our engineers can actually build.)
4. Own the Statement of Applicability (SoA) and the risk register, ensuring they're always up-to-date and accurately reflect our current security posture and any accepted risks. (This is the auditor's first stop, so it needs to be spot on.)
5. Mentor 0-2 junior information security analysts, providing technical guidance, reviewing their work, and generally helping them grow their compliance and security expertise. (You'll be sharing your hard-won knowledge and helping them get unstuck.)
6. Represent the Information Security team in cross-functional project meetings, providing expert advice on security requirements for new systems or services. (You'll be the voice of security, making sure it's considered from the start.)
7. Manage the remediation of audit findings and control gaps, working with relevant teams to make sure issues are fixed properly and on time. (It's not just about finding problems, but making sure they actually get solved.)
8. Conduct detailed third-party security assessments for critical vendors, reviewing their security posture and contractual agreements to identify and manage supply chain risks. (You're protecting us from risks introduced by others.)
9. Supervision: You'll typically have bi-weekly check-ins with your Lead or Manager, mostly for strategic alignment and to discuss any major roadblocks. For day-to-day work, you're expected to be pretty autonomous. You'll lead your own workstreams and projects, only pulling in your manager for truly novel or high-stakes issues.
10. Decision: You'll have full technical decision-making authority within your project scopes (e.g., choosing a specific control implementation, selecting a methodology for a risk assessment). For anything with a budget impact above, say, £10K, or changes to strategic direction, you'll need to consult with your Lead/Manager. You can make recommendations on hiring junior staff, but the final decision isn't yours yet. You're expected to make independent judgments on control effectiveness and risk ratings, escalating only when the risk appetite is exceeded or there's a significant business impact.
11. Success: Success looks like consistently passing internal audits with minimal findings, seeing your control designs effectively implemented, and junior team members developing well under your guidance. It also means being the person other teams naturally turn to for security advice because they trust your expertise and pragmatic approach.

Decision-Making Authority

• Type: Technical Control Implementation
• Entry: Proposes options, execution reviewed by Senior.
• Mid: Selects and implements standard controls, exceptions escalated.
• Senior: Designs and implements complex controls, makes technical trade-offs, consults on strategic impact.
• Type: Risk Acceptance
• Entry: Identifies and documents risks, proposes mitigations.
• Mid: Assesses and rates routine risks, recommends acceptance/mitigation to Senior.
• Senior: Evaluates and recommends acceptance of significant risks, justifies to Lead/Manager, documents thoroughly.
• Type: Audit Finding Remediation Strategy
• Entry: Executes assigned remediation tasks.
• Mid: Develops remediation plans for minor findings, gets approval from Senior.
• Senior: Defines and drives remediation strategy for Major/Minor findings, coordinates cross-functional teams, reports progress to Lead/Manager.
• Type: Third-Party Security Assessment Outcome
• Entry: Collects vendor security documentation.
• Mid: Reviews standard questionnaires, flags high-risk areas to Senior.
• Senior: Conducts in-depth assessments, determines vendor risk rating, recommends go/no-go or specific contractual clauses.

Competency Requirements

Foundation Skills (Transferable)

Beyond the technical stuff, there are some fundamental skills that are absolutely essential for thriving in this role. These are the bedrock that allows you to apply your expertise effectively and work well with everyone.

• Category: Communication & Influence
• Skills: Translating Technical Jargon: You can explain complex security risks and controls to non-technical audiences (like the CEO or Marketing team) in plain English, focusing on business impact.
• Active Listening: You're genuinely good at listening to stakeholder concerns and understanding their operational challenges before proposing security solutions.
• Persuasion & Negotiation: You can effectively advocate for security priorities and negotiate practical solutions when there are competing demands, without alienating people.
• Formal Presentation: You're comfortable presenting audit findings, risk assessments, and control recommendations to senior leadership, defending your points clearly.
• Category: Problem-Solving & Critical Thinking
• Skills: Root Cause Analysis: When an audit finding or incident occurs, you can dig deep to find the actual underlying cause, not just the symptom.
• Risk-Based Decision Making: You can weigh various factors—technical, business, regulatory—to make sound decisions about risk acceptance and mitigation strategies.
• Structured Analysis: You approach complex problems systematically, breaking them down into manageable parts and developing logical solutions.
• Prioritisation: You can effectively prioritise multiple competing security issues and projects based on their actual risk and business impact.
• Category: Organisation & Planning
• Skills: Project Management (Informal): You can plan and manage internal audit workstreams or control implementation projects, keeping track of deadlines and dependencies.
• Documentation Management: You're meticulous about maintaining accurate, up-to-date ISO 27001 documentation (SoA, policies, procedures, evidence).
• Time Management: You can juggle multiple tasks, from audit follow-ups to control reviews, and meet deadlines consistently.
• Attention to Detail: You catch the small discrepancies in evidence or policy wording that an external auditor would spot immediately.
• Category: Collaboration & Mentorship
• Skills: Cross-Functional Collaboration: You can work effectively with diverse teams (IT, Legal, Product, HR) to achieve security objectives.
• Conflict Resolution: You can navigate disagreements or differing priorities between teams in a constructive way.
• Coaching & Development: You're able to guide and teach junior team members, helping them understand complex security concepts and improve their work.
• Feedback Provision: You can give constructive feedback on work products and performance in a supportive manner.

Functional Skills (Role-Specific Technical)

These are the specific methodologies, tools, and industry knowledge you'll need to hit the ground running and really make an impact in this role.

Technical Competencies

• Skill: ISMS Implementation & Management (ISO/IEC 27001)
• Desc: You'll need deep expertise in designing, implementing, and continually improving an Information Security Management System. This means everything from scoping and risk assessment to internal audits and management reviews. You're the go-to person for all things 27001.
• Level: Advanced
• Skill: Risk Management Frameworks (NIST RMF, ISO 31000, FAIR)
• Desc: You're adept at conducting both quantitative (like FAIR) and qualitative risk assessments. You can define risk appetite, manage a robust risk register, and translate technical issues into clear business impact for leadership.
• Level: Advanced
• Skill: Control Frameworks & Auditing (COBIT, CIS Controls, SOC 2)
• Desc: You'll master mapping controls across various frameworks to avoid redundant work – we call it 'audit once, report many'. You'll also manage external audits, from coordinating responses to negotiating findings.
• Level: Advanced
• Skill: Business Continuity & Disaster Recovery (BCDR)
• Desc: You'll be involved in planning, documenting, and testing our BCDR plans, often through tabletop exercises. The goal is to ensure we can recover from any major incident within our defined recovery objectives (RTO/RPO).
• Level: Intermediate
• Skill: Supply Chain / Third-Party Risk Management (TPRM)
• Desc: You'll develop and manage programmes to assess the security posture of our critical vendors. This includes contract reviews, security questionnaires (like SIG, CAIQ), and ongoing monitoring to keep our supply chain secure.
• Level: Advanced

Digital Tools

• Tool: GRC Platforms (e.g., ServiceNow GRC, OneTrust, Archer)
• Level: Advanced
• Usage: You'll be configuring modules, building custom workflows for risk assessments, and designing dashboards for management to track our compliance posture and risk register. You'll train others on how to use it effectively.
• Tool: Audit Management (e.g., AuditBoard, HighBond, Vanta)
• Level: Expert
• Usage: You'll manage the end-to-end audit lifecycle within the tool, from planning internal audits to tracking remediation. You'll be the person who trains business users on how to respond to audit requests and upload evidence.
• Tool: Vulnerability Management (e.g., Nessus, Qualys, Tenable.io)
• Level: Advanced
• Usage: You'll design targeted scan policies, validate findings to eliminate false positives, and prioritise remediation based on business context. You'll work with IT to make sure critical vulnerabilities are addressed quickly.
• Tool: Cloud Security Posture (e.g., Wiz, Palo Alto Prisma Cloud, Orca Security)
• Level: Advanced
• Usage: You'll investigate complex misconfigurations, write custom policies for our cloud environments, and work with our DevOps teams to integrate security checks directly into our CI/CD pipelines. This means securing AWS, Azure, and GCP.
• Tool: Collaboration & Doc Mgmt (e.g., Confluence, Jira, SharePoint)
• Level: Expert
• Usage: You'll design the ISMS documentation structure in Confluence, create automated Jira workflows for incident response and audit findings, and set up SharePoint permission models for sensitive documents. You're the architect of our knowledge base.
• Tool: Executive Reporting (e.g., Power BI, Tableau)
• Level: Advanced
• Usage: You'll build interactive dashboards, connecting data from our GRC and security tools. This helps us visualise risk trends and present clear, concise reports to senior leadership and management reviews.

Industry Knowledge

• Area: Information Security Best Practices
• Desc: A solid understanding of industry-recognised security principles, architectures, and common attack vectors. You know what 'good' looks like beyond just the standards.
• Area: IT Infrastructure & Cloud Fundamentals
• Desc: Enough knowledge of networks, operating systems, and cloud platforms (AWS, Azure, GCP) to understand the technical implications of security controls and risks.
• Area: Software Development Lifecycle (SDLC) Security
• Desc: Understanding how security can be embedded throughout the SDLC, from design to deployment, to build secure products from the ground up.

Regulatory Compliance Regulations

• Reg: International Privacy Regulations (GDPR, CCPA, etc.)
• Usage: You'll understand the interplay between security controls and privacy requirements across different legal jurisdictions. This includes data mapping, DPIAs, and breach notification obligations. You'll ensure our security measures support our privacy compliance.
• Reg: ISO 27001 / ISO 27002
• Usage: This is your bread and butter. You'll apply the principles of ISO 27001 for ISMS implementation and certification, and ISO 27002 for practical control guidance. You'll be the internal authority on these standards.
• Reg: Industry-Specific Compliance (e.g., PCI DSS, HIPAA if applicable)
• Usage: Depending on our specific business operations, you might need to understand and apply other industry-specific regulations. You'll be able to quickly get up to speed on these and integrate them into our ISMS.

Essential Prerequisites

• A minimum of 5 years' dedicated experience in an information security or GRC role, with a strong focus on ISO 27001.
• Proven experience leading internal audits and managing external audit processes for ISO 27001 certification.
• Demonstrable experience in designing, implementing, and optimising security controls within an ISMS.
• Strong understanding of risk management principles and experience maintaining a risk register.
• Experience working with GRC platforms and other security tools (as listed in the tech stack) at an advanced level.
• Excellent written and verbal communication skills, especially for explaining complex technical concepts to non-technical stakeholders.

Career Pathway Context

We're looking for someone who has genuinely 'done the doing' when it comes to ISO 27001. You're not just familiar with the standard; you've lived and breathed it, from scoping to certification. This isn't a role for someone who's only been involved in a small part of the process; we need someone who understands the whole lifecycle and can lead others through it.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: AI-Powered Compliance Automation
• Why: Compliance teams are drowning in evidence collection and manual checks. AI is rapidly changing this, automating huge chunks of routine tasks. Competitors are already using AI to cut audit prep time by half. You won't just be using these tools; you'll be configuring and optimising them.
• Concepts: [{'concept_name': 'Automated Evidence Collection (AEC)', 'description': 'Understanding how AI tools connect to cloud environments and SaaS applications to automatically gather proof of control implementation.'}, {'concept_name': 'Compliance-as-Code (CaC)', 'description': 'The idea of defining compliance rules in code, allowing for automated validation and continuous monitoring, rather than manual checks.'}, {'concept_name': 'AI-driven Policy Generation', 'description': 'Using large language models (LLMs) to draft and update security policies and procedures, ensuring they align with standards and best practices.'}, {'concept_name': 'Predictive Compliance Analytics', 'description': 'Using AI to analyse historical data and predict potential compliance gaps or audit findings before they occur.'}]
• Prepare: This week: Explore the AI features in our existing GRC platforms (ServiceNow, OneTrust). What can they do already?
• This month: Experiment with an enterprise-grade LLM (like Microsoft Copilot or Google Gemini Enterprise) to draft a simple security procedure or audit report summary.
• Month 2: Work with an IT or DevOps colleague to understand how 'Compliance-as-Code' principles could apply to one of our cloud environments.
• Month 3: Identify one manual evidence collection task that could realistically be automated with an AI tool and propose a pilot project.
• QuickWin: Start using AI tools to summarise lengthy internal documents or draft initial email responses to audit queries. It's low risk and immediately saves time.
• Skill: Cyber Resilience & Adaptive Security
• Why: The threat landscape is changing so fast that traditional 'perimeter defence' isn't enough. We need to build systems that can not only prevent attacks but also quickly recover and adapt when an incident inevitably happens. Auditors are increasingly looking for evidence of resilience, not just prevention.
• Concepts: [{'concept_name': 'Zero Trust Architecture (ZTA)', 'description': "Moving away from 'trust but verify' to 'never trust, always verify', regardless of location. This impacts how we design access controls."}, {'concept_name': 'Chaos Engineering for Security', 'description': 'Proactively injecting failures or simulated attacks into systems to test their resilience and identify weaknesses before real incidents.'}, {'concept_name': 'Security Orchestration, Automation, and Response (SOAR)', 'description': 'Automating security tasks and incident response workflows to speed up detection and containment.'}, {'concept_name': 'Business Resilience Integration', 'description': 'Ensuring our BCDR plans are tightly integrated with our wider business resilience strategy, not just IT recovery.'}]
• Prepare: This week: Read up on Zero Trust principles and how they apply to ISO 27001 Annex A controls (e.g., A.9 Access Control).
• This month: Review our current incident response plan. Where could automation or adaptive measures improve it?
• Month 2: Participate in a tabletop exercise. Pay close attention to how quickly teams can adapt to unexpected scenarios.
• Month 3: Research SOAR platforms and how they could enhance our security operations, then present a brief overview to the team.
• QuickWin: Start thinking about how to apply 'least privilege' principles more rigorously in your control designs. It's a core ZTA concept and has immediate security benefits.

Advancing Technical Skills

• Skill: Advanced Cloud Security Posture Management (CSPM)
• Why: More and more of our infrastructure and data are moving to the cloud. You'll need to go beyond basic monitoring to proactively identify and remediate complex misconfigurations and ensure continuous compliance in multi-cloud environments.
• Concepts: [{'concept_name': 'Cloud Native Security Tools', 'description': 'Deep understanding of security features and services within AWS, Azure, and GCP (e.g., AWS Security Hub, Azure Security Center, GCP Security Command Centre).'}, {'concept_name': 'Infrastructure as Code (IaC) Security', 'description': 'Reviewing and securing Terraform, CloudFormation, or ARM templates to prevent misconfigurations before deployment.'}, {'concept_name': 'Container and Kubernetes Security', 'description': 'Understanding the unique security challenges and controls for containerised applications and orchestration platforms.'}, {'concept_name': 'Serverless Security', 'description': 'Securing functions-as-a-service (FaaS) and other serverless components.'}]
• Prepare: This week: Pick one cloud platform (AWS, Azure, or GCP) and dive into its native security services documentation.
• This month: Work with a cloud engineer to review a Terraform template for security vulnerabilities.
• Month 2: Complete an online course on container or Kubernetes security.
• Month 3: Propose an improvement to our cloud security baseline based on your new knowledge.
• QuickWin: Familiarise yourself with the top 10 cloud security risks (e.g., from OWASP) and see how they map to our current cloud environment.

Education Requirements

• Level: Minimum
• Req: A Bachelor's degree (or equivalent OFQUAL Level 6 qualification) in Information Security, Computer Science, or a related technical field.
• Alts: We're pragmatic here. If you've got significant, demonstrable industry experience (8+ years) in a senior information security role, especially with a strong ISO 27001 focus, we'll consider that as equivalent to a degree. Show us what you've built and achieved.
• Level: Preferred
• Req: A Master's degree (or equivalent OFQUAL Level 7 qualification) in Information Security or a related discipline.
• Alts: While a Master's is nice to have, it's not a deal-breaker. Practical experience and relevant certifications often carry more weight for us.

Experience Requirements

You'll need a solid 5-8 years of dedicated experience within information security, with a significant chunk of that focused on ISO 27001 implementation, auditing, and management. We're looking for someone who has genuinely led internal audits, designed controls, and managed the ISMS lifecycle. This isn't your first rodeo with ISO 27001; you've been in the trenches and know what it takes to get and stay certified.

Preferred Certifications

• Cert: Certified Information Systems Security Professional (CISSP)
• Prod: ISC2
• Usage: Demonstrates a broad, deep understanding of information security principles and practices across multiple domains, which is highly valuable for holistic ISMS management.
• Cert: Certified Information Security Manager (CISM)
• Prod: ISACA
• Usage: Shows expertise in information security governance, programme development, and incident management, aligning well with the strategic elements of this role.
• Cert: Cloud Security Certifications (e.g., CCSK, CCSP, AWS/Azure/GCP Security)
• Prod: CSA, ISC2, Cloud Providers
• Usage: Given our increasing reliance on cloud infrastructure, understanding cloud-specific security challenges and controls is a significant advantage.

Recommended Activities

• Regularly attend industry conferences (e.g., Infosec Europe, Black Hat) to stay current on threats and best practices.
• Participate in relevant online communities or forums to share knowledge and learn from peers.
• Dedicate time each week to reading industry publications, threat intelligence reports, and regulatory updates.
• Seek out opportunities to mentor junior colleagues or present on security topics internally.
• Consider pursuing additional certifications that align with your career goals or emerging technologies.

Career Progression Pathways

Entry Paths to This Role

• Path: Information Security Specialist (ISO 27001)
• Time: 3-5 years
• Path: GRC Analyst / Consultant (External)
• Time: 4-6 years
• Path: IT Auditor (Internal/External)
• Time: 4-7 years

Career Progression From This Role

• Pathway: Lead ISO 27001 Auditor / InfoSec Manager
• Time: 2-4 years in role

Long Term Vision Potential Roles

• Title: Principal Security Architect / Senior Manager, Global Compliance (L5)
• Time: 5-8 years
• Title: Director, International Information Security (L6)
• Time: 8-12 years
• Title: Chief Information Security Officer (CISO) (L7)
• Time: 12-15+ years

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.