UK

United Kingdom · Compliance, quality and safety · Mid-Level (2-5 years)

ISO 27001 Information Security Manager

Here is the whole job, in plain words. What it is, what you decide, how you're judged, how people get here and where they go next. Learn with AI tutors who work through practical tasks with you.

Your Job Description
Your experience is the starting point for your next move.

Bring Your Experience With You

A Job Description Is a Starting Point.

Read what the role involves. Then think about your own work: what feels familiar, and what would you like to practise?

See how AI is changing this job, and get the full read by email.

Start My Free Automation Fluency Module

As an ISO 27001 Information Security Manager, a good place to start on AI for Compliance Automation (Prompt Engineering) is Automating a Repeated Task in Own Work, a free Future Fluency module at Level 3. You'd practise automating the part of a weekly task that never changes, and checking it really saves you time.

Free to start, no card.

Keep this job description

Where Should We Send It?

One email: what AI is changing in this job, the new skills it asks for, where it leads, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Your employer, or 'self-employed'

Leading a team? Try this with up to five of them for 14 days, free.

  • Experience bandMid-Level (2-5 years)
  • Direct reportsNo direct reports
  • Reports toSenior ISO 27001 Information Security Manager
  • UK framework levelUsually a coordinator, or early in a professional job

Also advertised as Information Security Analyst (ISO 27001) · Compliance Analyst (InfoSec) · ISMS Specialist

Built on 43,079 real UK job descriptions we analysed · grounded in what real qualifications cover

Two short quizzes about you

1From This Job To A Course

The qualifications matched to this job

Qualifi Level 2 Diploma in Business Beginners in Cyber Security Qualifi Ltd · Level 2 · covers 2 of 6 standards
Transcend Level 5 Diploma in Risk Management of Security Operations Transcend Awards · Level 5 · covers 1 of 6 standards
SFJ Awards Level 4 Certificate for Protective Security Advisers SFJ Awards · Level 4 · covers 2 of 6 standards
NCFE Level 4 Diploma: Cyber Security Engineer NCFE · Level 4 · covers 1 of 6 standards
QNUK Level 4 Award in Security & Risk Management (G4S) (RQF) Qualifications Network · Level 4 · covers 1 of 6 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Cyber Security Solutions Qualifi Level 2 Diploma in Business Beginners in Cyber Security
Security operations solutions and service management Transcend Level 5 Diploma in Risk Management of Security Operations
Legislation and governance NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma)
Incident Response and Management SFJ Awards Level 4 Certificate for Protective Security Advisers
Risk assessment in cyber security NCFE Level 4 Diploma: Cyber Security Engineer
Security and risk management QNUK Level 4 Award in Security & Risk Management (G4S) (RQF)

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
AI Governance Fluency using AI responsibly
Automation Fluency building AI into how work runs
Sustainability Fluency building care for people and planet into the work
Your Plan Illustration

Built for ISO 27001 Information Security Manager

6 units that map to this job, from the qualifications that cover it.

  1. Cyber Security Solutions Qualifi Ltd · covers 2 of 6 standards Level 2
  2. Security operations solutions and service management Transcend Awards · covers 1 of 6 standards Level 5
  3. Legislation and governance NCFE · covers 3 of 6 standards Level 3
  4. Incident Response and Management SFJ Awards · covers 2 of 6 standards Level 4
  5. Risk assessment in cyber security NCFE · covers 1 of 6 standards Level 4
  6. Security and risk management Qualifications Network · covers 1 of 6 standards Level 4
An illustration of the units matched to this role. The order reflects those matches, without any learner progress.

2AI and this work

Will AI change your work as an ISO 27001 Information Security Manager?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

The new skills this role is being asked for

  • AI for Compliance Automation (Prompt Engineering)
  • Cloud Security Fundamentals (Azure/AWS/GCP)
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What Happens When You Start

Next, a free account. We build your ISO 27001 Information Security Manager plan as you set up, starting with the free Automation Fluency module. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Ready to pay? Subscribe for £70 a month

Keep this read. One email with what AI is changing in this job, the new skills it asks for and where to start free. Nothing else follows unless you confirm your address.

3What This Role Really Is

This job keeps an ISO 27001 information security management system (ISMS) working day-to-day. It involves making sure specific controls are in place and proving they are effective, through practical work with policies, processes and people.

4What You’d Actually Use The tools this job runs on, and how well you'd need to know each one.
GRC Platforms (e.g., OneTrust, ServiceNow GRC) Intermediate

Updating risk registers, uploading evidence for controls, tracking corrective actions, and running pre-built reports. You'll be following existing workflows.

Vulnerability Management (e.g., Tenable.io, Qualys VMDR) Basic

Accessing dashboards to pull reports on critical vulnerabilities for your assigned assets and assigning remediation tickets in Jira. You'll interpret basic scan results.

Collaboration & Documentation (e.g., Confluence, Jira, MS Teams/SharePoint) Intermediate

Documenting meeting minutes, updating control descriptions in Confluence, managing evidence-gathering tasks in Jira, and collaborating with teams on SharePoint.

SIEM & Security Analytics (e.g., Microsoft Sentinel, Splunk) Basic

Understanding how to search for basic events to provide evidence for an incident or audit request (e.g., 'Show me all admin logins for server X').

Cloud Security Posture Management (CSPM) (e.g., Wiz, Orca Security) Basic

Navigating the platform to find misconfigurations related to specific assets or compliance checks (e.g., 'public S3 buckets') that impact your controls.

Executive Reporting (e.g., Power BI, Tableau) Basic

Populating pre-built templates with data from GRC and vulnerability management tools to contribute to management review reports.

5What You Get To Decide, And How That Grows Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.
The choiceComing in Where you are nowThe step above
Control Implementation Approach Proposes options, requires full approval. Decides approach for routine controls within established policy; consults manager for novel situations. Defines approach for complex controls; consults director on strategic impact.
Evidence Collection Methods Follows pre-defined methods, seeks guidance for variations. Independently selects and executes appropriate evidence collection methods; escalates if requiring significant stakeholder effort. Designs and optimises evidence collection processes across multiple control areas.
Documentation Updates (Minor) Suggests edits, requires manager review before publishing. Independently updates and publishes minor changes to procedures or control descriptions, ensuring alignment with policy. Approves major documentation changes and new policy drafts.
Corrective Action Prioritisation Prioritises based on manager's direction. Prioritises assigned corrective actions based on risk and impact, flagging conflicts to manager. Defines prioritisation framework for all corrective actions across the ISMS.
6How You’ll Be Judged The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.
Evidence Collection Timeliness
How quickly and reliably you gather the necessary evidence for your assigned controls when an audit or internal review comes knocking. This is about hitting deadlines.
Target · 98% of evidence requests fulfilled by the internal due date.

If we ask for evidence for 50 controls by Friday, you'll have 49 of them ready to go. That one missing piece? You'll know exactly why and have a plan to get it.

Control Review Accuracy
The quality and correctness of your work when reviewing controls. Are you spotting the gaps? Is your documentation spot on?
Target · <2 errors found per 25 controls reviewed by senior staff.

Your manager reviews your documentation for 25 controls and only finds one minor typo and a slightly unclear sentence. That's a win.

Corrective Action Closure Rate
How many of the corrective actions (CAPs) assigned to you or the controls you manage actually get sorted out on time.
Target · 85% of assigned Corrective Action Plans (CAPs) closed within the agreed-upon timeframe.

If you're responsible for 10 CAPs this quarter, you'll make sure 8 or 9 of them are fully resolved and documented by their due dates. For the others, you'll have a solid reason and an updated plan.

Control Effectiveness
It's not just about having a control, but making sure it actually does what it's supposed to. Your controls should hold up under scrutiny.
  • Controls you manage consistently pass internal reviews with minimal findings. You're able to 'walk the auditor through it' confidently, showing the intent, the policy, and the technical evidence without a hitch. We'll see fewer questions from auditors about the controls you oversee.
Documentation Quality
Your policies, procedures, and evidence records need to be clear, concise, and easy to understand for anyone picking them up.
  • Auditors and internal teams can easily follow your documentation. There's no ambiguity, and everything's up-to-date. You'll get positive feedback from colleagues who use your documents, saying they're actually helpful, not just 'shelf-ware'.
Proactive Issue Identification
We don't want to just fix problems after they're found; we want you to spot potential weaknesses before they become bigger issues.
  • You're flagging potential control gaps or areas of non-compliance to your manager before an audit even begins. You're suggesting improvements to processes or documentation that prevent future problems. You're not waiting for someone else to tell you something's broken.
Stakeholder Engagement & Influence
You'll need to work with other teams to get things done. This isn't about telling people what to do, but getting them on board.
  • Teams are generally responsive to your requests for evidence or updates. You're able to explain security requirements in a way that makes sense to non-security people. You'll get feedback that you're easy to work with and help them understand why security matters, not just that it's a burden.
7Would You Like It What people enjoy about the work, and what they find difficult.
What People Enjoy
Ensuring Compliance & Order

You'll get a real kick out of making sure everything aligns perfectly with the ISO 27001 standard, knowing that your meticulous work keeps us certified. There's a deep satisfaction in seeing processes work smoothly and documentation being pristine.

Successfully closing out a complex corrective action plan, knowing all the evidence is in place and the control is now solid.

Solving Security Puzzles

You'll enjoy figuring out how to implement a control in a practical way that fits our business, or digging into why a control might have failed. It's about finding solutions that genuinely improve our security.

Working with the IT team to adapt a generic policy into a specific procedure for a new cloud service, making it both compliant and usable.

Making a Tangible Impact

You'll appreciate seeing your direct contributions translate into a more secure organisation and successful audit outcomes. Your work isn't abstract; it has real consequences for our business and our customers.

Receiving positive feedback from an external auditor about the clarity of your evidence package, knowing your efforts directly contributed to a smooth audit.

What Frustrates People
  • The 'Evidence Chase': Spending a significant chunk of your time trying to get busy engineers and managers to give you the evidence they promised weeks ago. It's like pulling teeth sometimes.
  • 'Security as the Department of No': Constantly having to fight the perception that your job is to block new business initiatives rather than help them happen securely. You'll hear this one a lot.
  • Audit Fatigue: The seemingly endless cycle of internal audits, external surveillance audits, and re-certification audits can be pretty draining for everyone, including you.
  • Inheriting a 'Shelf-ware' ISMS: Taking over a beautifully written, but completely unimplemented, set of policies from a previous role or consultant. It means you're effectively starting from scratch to make it real.
  • The 'Paper vs. Reality' Gap: The constant struggle to make sure what's written in our policies actually matches what's happening on the ground. Sometimes, it feels like two different worlds.
  • Stakeholder Amnesia: Getting key people to agree to implement a control, only for them to have completely forgotten about it six months later when the auditor shows up. You'll need a good memory and even better tracking.
What This Role Does Not Give You
  • A quiet, predictable 9-to-5: While there's routine, urgent requests and audit deadlines mean things can get hectic.
  • Direct control over technical teams: You'll influence, not command. This means persuasion is your superpower.
  • A role where you're building new software or directly managing IT infrastructure: Your focus is on the management system around security, not the hands-on tech deployment.
  • A 'set it and forget it' environment: ISO 27001 is all about continual improvement, so you're always looking for ways to make things better.
8Who You Work With

Your work here is pretty fundamental. You're directly responsible for ensuring a significant portion of our information security controls are effective and provable. Get it right, and we maintain our certification, protect our customer data, and build trust. Get it wrong, and we face audit failures, reputational damage, and potentially hefty fines. It's not always glamorous, but it's absolutely essential to our business.

Inside The Business
  • Your Manager (for guidance and strategy alignment)
  • IT Operations and Engineering Teams (they're the ones implementing the controls)
  • HR and Legal Teams (for policy reviews and compliance)
  • Product Teams (to ensure new features are secure by design)
  • Internal Audit Team (you'll be working closely with them to prepare for external audits)
Outside The Business
  • External ISO 27001 Auditors (you'll be showing them the evidence)
  • Key Vendors and Suppliers (making sure their security aligns with ours)
9What You Need Before You Start Not a wish list. The things you would be expected to already have.
  • At least 2-5 years of hands-on experience in an information security, IT audit, or compliance role.
  • Demonstrable practical experience with ISO 27001, ideally having been involved in at least one full audit cycle (internal or external).
  • A track record of managing documentation and evidence collection for security controls.
  • Experience working with GRC platforms or similar tools for tracking compliance activities.
  • Strong organisational skills and a keen eye for detail – you'll be dealing with a lot of specifics.
10What To Practise Next Where the job is going, and what to do about it starting this week.
Advanced GRC Platform Configuration

As our ISMS matures, we'll need to customise our GRC platform more to fit our specific processes, automate workflows, and create more insightful dashboards. You'll need to understand how to make the tool work for us, not the other way around.

Workflow Automation · Custom Dashboard Creation · Data Model Understanding

  • This quarter: Volunteer to help with any GRC platform configuration projects or enhancements.
  • Next 6 months: Complete any advanced user training offered by our GRC platform vendor.
  • Next 12 months: Work with your manager to identify one area where a custom dashboard or workflow would significantly improve efficiency and try to build it.

Quick win: Explore all the existing configuration options and reporting features within our current GRC platform. You might find some hidden gems.

11Staying Current Once You Are In
What People Here Do To Keep Up
  • Attending industry webinars and conferences (even virtual ones) to stay on top of the latest security trends and compliance challenges.
  • Joining professional groups or online communities focused on ISO 27001 or information security to share knowledge and learn from peers.
  • Taking online courses on specific cloud security platforms (AWS, Azure) if you don't have much cloud experience, as this is becoming increasingly important.
  • Reading relevant industry publications and blogs to keep your knowledge current and spot emerging risks.

12The Rising Capability

The rising capability

Zavmo analysis

Skills This Job Is Starting to Need

These skills come from Zavmo's analysis of how this job is changing. Choose one you can practise in your current work.

AI for Compliance Automation (Prompt Engineering)

Competitors are already using AI tools to automate parts of their compliance work, from drafting policies to summarising audit findings. Those who can use these tools effectively will be significantly more productive and efficient, freeing up time for higher-value work.

  • Effective Prompting for Compliance
  • AI Output Validation
  • Ethical AI Use in Compliance
  • Integration with GRC Tools

Cloud Security Fundamentals (Azure/AWS/GCP)

Most organisations are moving more and more of their infrastructure and data to the cloud. ISO 27001 controls need to be applied just as rigorously in cloud environments, but the 'how' is often very different from on-premise. You'll need to understand the basics to ensure compliance.

  • Shared Responsibility Model
  • Cloud Identity and Access Management (IAM)
  • Cloud Storage Security
  • Cloud Security Posture Management (CSPM)

13Skills You Will Use

What you’ll use

Skills This Role Draws On

Technical

  • ISO/IEC 27001/27002 Framework Mastery
  • Risk Assessment & Management Methodologies
  • Internal & External Audit Management
  • Security Policy Lifecycle Management
  • Security Awareness & Training Program Development

14The Pathway

The pathway

Ways Into This Job

These are possible routes into the job in the UK. Your route depends on the skills and experience you already have.

  1. 1

    Information Security Analyst

    2-3 years

    Skills to master

    • Basic security principles, incident response support, vulnerability scanning, initial evidence gathering for audits, understanding of IT systems.

    You're ready to move on when

    • Consistently delivers accurate reports and evidence.
    • Proactively identifies minor security issues.
    • Can clearly explain basic security concepts to non-technical colleagues.
    • Shows a keen interest in compliance frameworks like ISO 27001.
  2. 2

    IT Auditor / Compliance Officer (General)

    2-4 years

    Skills to master

    • Audit methodologies, understanding of internal controls, risk assessment basics, regulatory knowledge (e.g., GDPR), interviewing stakeholders.

    You're ready to move on when

    • Successfully conducted internal audits or compliance reviews.
    • Can identify control weaknesses and suggest improvements.
    • Strong documentation and report-writing skills.
    • Familiarity with various compliance frameworks, even if not ISO 27001 specific.
  3. 3

    IT Systems Administrator with Security Focus

    3-5 years

    Skills to master

    • Deep technical knowledge of systems, networks, and cloud platforms, hands-on security configuration, troubleshooting security issues, understanding of security tools.

    You're ready to move on when

    • Demonstrated ability to implement security controls at a technical level.
    • Proactively identifies and remediates security vulnerabilities.
    • Understands the impact of technical configurations on compliance.
    • Shows a desire to move from hands-on implementation to security management and governance.

15Where This Role Leads

The long view: This work starts with the fundamentals of ISO 27001. From here, it can lead to roles such as ISMS Manager or Information Security and Compliance Manager, with wider responsibility for security and compliance.

The ten Future Fluencies

Zavmo analysis

Skills for the Work Ahead

These ten skill areas can help you adapt as work changes. Choose one to practise alongside the skills your role needs today.

The highlighted areas are linked to ISO 27001 Information Security Manager in Zavmo’s analysis.

Where it leads

Roles this leads to

Learning That Starts With You

Learn One to One, Through Your Own Work

Work through practical tasks with your AI tutor. You explain your choices, try things out and learn at your pace.

A lesson from Cyber Security Solutions, worked against ISO 27001 Information Security Manager.

Cyber Security Solutions Level 2

Applied to your work in ISO 27001 Information Security Manager

This unit aims to provide learners with an understanding of the importance of a security-conscious mindset when using ICT, including responsible online behaviour. Learners will also understand how physical security adjustments and Crime Prevention Through Environmental Design (CPTED) principles can strengthen cyber security plans, and the purpose of the ISO27001 Information Management Security Standard.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a lesson linked to this role. The unit description and outcomes are shown as supplied in the qualification record.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

See Your Progress Grow Illustration
ISO 27001 Information Security Manager
  • ISO/IEC 27001/27002 Framework Mastery
  • Risk Assessment & Management Methodologies
  • Internal & External Audit Management
  • Security Policy Lifecycle Management
  • Security Awareness & Training Program Development
This illustration shows skills from this role. Each topic lights up as you show what you can do. Your record stays with you between jobs.

16The Details

More About This Role

See the roles you could work towards, ways to use AI and answers to common questions.

Where You Could Go Next

Where it leads

Where You Could Go Next

These roles build on experience in this job. Compare the skills and responsibilities involved.

  1. Senior ISO 27001 Information Security Manager (Level 003)

    3-5 years in this role

    You'll move from owning specific controls to leading entire workstreams, managing internal audits, and being the primary point of contact for external auditors. You'll also start mentoring junior colleagues.

    • Leading Internal Audit Programmes Designing and executing internal audit schedules, managing findings end-to-end.
    • External Audit Management Acting as the main interface with external auditors, negotiating scope and wording of findings.
    • ISMS Design & Improvement Proposing and implementing significant improvements to the overall ISMS structure and processes.
    • Risk Treatment Decision Making Making technical decisions on how to treat identified risks, within defined parameters.
Working With AI

Working with AI

Where AI is starting to help

Let's be real, managing ISO 27001 can involve a fair bit of repetitive, time-consuming work. But here's the thing: AI isn't here to replace you. It's here to give you superpowers, helping you blast through the tedious bits so you can focus on the stuff that actually needs your brainpower.

Imagine spending less time chasing evidence or drafting policies from scratch. AI tools are becoming seriously smart, and they can handle a surprising amount of the grunt work involved in maintaining our ISMS. This means you can be more efficient, more proactive, and frankly, less stressed.

Automated Evidence Collection

Use smart GRC platforms (like Vanta or Drata) that connect directly to our cloud services (AWS, Azure), HR systems, and code repositories. They'll automatically gather evidence for technical controls, meaning you spend way less time chasing screenshots and more time verifying.

Accelerated Control Mapping

Got a new regulation or framework to consider? Instead of manually mapping its requirements to our existing ISO 27001 controls in a spreadsheet, AI can do it in minutes. It'll instantly highlight gaps, saving you days of painstaking analysis.

AI-Assisted Policy Drafting

Starting a new security policy or procedure from a blank page is tough. Use a large language model (LLM) to generate a solid first draft. Give it the control objective (e.g., A.8.1.1 - Asset Management) and our company specifics, and you'll have a great starting point in minutes, not hours.

Proactive Control Monitoring

Employ AI-driven analytics within our SIEM (like Microsoft Sentinel) to spot unusual patterns that might mean a control is failing. Think odd data access or login behaviours. This helps you catch potential issues before an auditor (or a hacker!) does, shifting you from reactive to proactive.

Common Questions

Common Questions

How do you become an ISO 27001 Information Security Manager?

Common routes in include Information Security Analyst (2-3 years), IT Auditor / Compliance Officer (General) (2-4 years) and IT Systems Administrator with Security Focus (3-5 years). Times vary with prior experience.

Where can an ISO 27001 Information Security Manager progress to?

This role can lead on to Senior ISO 27001 Information Security Manager (3-5 years in this role), depending on the skills you build.

What new skills matter most for an ISO 27001 Information Security Manager?

Increasingly, AI for Compliance Automation (Prompt Engineering) and Cloud Security Fundamentals (Azure/AWS/GCP). These are the skills our record of this role lists as growing.

Free tools

Find Your Next Step

Try a free check to see where you stand. No account needed.

Read the Zavmo manifesto to understand how you will be taught Meet your tutors

Or try another one

17Where To Go From Here

Other roles at Level 3

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

 More jobs in compliance, quality and safety

Stay in the field you know and move sideways rather than up.
If you leave this industry

ISO 27001 is used across sectors, from finance to tech to healthcare. Skills in compliance, risk management and audit apply in almost any industry, which makes this work transferable across sectors.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

Start with Your Experience

From Your Role to Your Next Role

Consider the work you do now, the role you want and the learning behind your next step.

Product examples and illustrations Read the Transcript

The Practical Arrangements

Teaching and the Qualification

Search and plan for free. Your first Future Fluency module is free. Further teaching is £70 a month, billed monthly. Cancel any time.

Zavmo is not the awarding body or an approved centre. Formal registration, assessment and certification are separate arrangements.

Check the awarding body’s current requirements before committing to a qualification route.

Your Next Step

Put This Role in Your Path

Bring your experience and the work you want to do next. Use ISO 27001 Information Security Manager as your starting point and try a Future Fluency module before deciding whether to pay.

Continue With This Role

Create your free account to take the next step. Your first Future Fluency module is free. No card needed.

Your Job Description
Your experience is the starting point for your next move.