UK

United Kingdom · Technology and data · Principal/Manager (12-16 years)

IT Security Manager

Here is the whole job, in plain words. What it is, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

See how AI is changing this job, and get the full read by email.

Start my free Automation Fluency module

As an IT Security Manager, a good place to start on Ethical AI Governance & Security is Planning Automation Across a Department, a free Future Fluency module at Level 5. You'd practise working out what in your department's work could be automated, what should not be, and what to recommend.

Free to start, no card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, the new skills it asks for, where it leads, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Your employer, or 'self-employed'

Leading a team? Try this with up to five of them for 14 days, free.

  • Experience bandPrincipal/Manager (12-16 years)
  • Direct reports5-8 reports
  • Reports toDirector of Information Security
  • UK framework levelUsually a manager, or the deepest specialist in a team

Also advertised as Security Operations Manager · Information Security Manager · GRC Manager · Head of Security Engineering

Built on 43,079 real UK job descriptions we analysed · grounded in what real qualifications cover

Two short quizzes about you

1From this job to a course

The qualifications matched to this job

Qualifi Level 5 Extended Diploma in Cyber Security Qualifi Ltd · Level 5 · covers 5 of 13 standards
Qualifi Level 5 Extended Diploma in Networking and Cyber Security Qualifi Ltd · Level 5 · covers 2 of 13 standards
SEG Awards Level 5 Diploma in Software Engineering with Cyber Security Skills and Education Group Awards · Level 5 · covers 1 of 13 standards
NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma) NCFE · Level 3 · covers 4 of 13 standards
SFJ Awards Level 4 Certificate for Protective Security Advisers SFJ Awards · Level 4 · covers 4 of 13 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Incident Response, Investigations and Forensics Qualifi Level 5 Extended Diploma in Cyber Security
Detecting Complex Cyber Threats to Critical National Infrastructure SFJ Awards Level 5 Award in Industrial Cyber Security – Detect, Respond, Recover
Incident Response and Intrusion Detection SEG Awards Level 5 Diploma in Software Engineering with Cyber Security
Incident response and disaster recovery NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma)
Incident Response and Management SFJ Awards Level 4 Certificate for Protective Security Advisers

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
AI Governance Fluency using AI responsibly
Systems Fluency seeing the whole picture
Trust Fluency keeping the digital world safe
Your Plan Illustration

Built for IT Security Manager

5 units that map to this job, from the qualifications that cover it.

  1. Incident Response, Investigations and Forensics Qualifi Ltd · covers 5 of 13 standards Level 5
  2. Detecting Complex Cyber Threats to Critical National Infrastructure SFJ Awards · covers 1 of 13 standards Level 5
  3. Incident Response and Intrusion Detection Skills and Education Group Awards · covers 1 of 13 standards Level 5
  4. Incident response and disaster recovery NCFE · covers 4 of 13 standards Level 3
  5. Incident Response and Management SFJ Awards · covers 4 of 13 standards Level 4
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as an IT Security Manager?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

The new skills this role is being asked for

  • Ethical AI Governance & Security
  • Advanced Cyber Resilience & Business Continuity Integration
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your IT Security Manager plan as you set up, starting with the free Automation Fluency module. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Ready to pay? Subscribe for £70 a month

Keep this read. One email with what AI is changing in this job, the new skills it asks for and where to start free. Nothing else follows unless you confirm your address.

3What this role really is

An IT Security Manager oversees an organisation's defences against cyber threats, managing systems, people and response plans. The role carries real responsibility for how well those defences hold up and how the team performs.

4What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

Splunk Enterprise Security / Microsoft Sentinel (SIEM) Strategic

You'll manage the platform's budget, evaluate its effectiveness (MTTD/MTTR), and use its data for executive risk reporting. You'll guide your team on complex query writing and correlation rule tuning, ensuring we get the right alerts.

CrowdStrike Falcon / SentinelOne (EDR/XDR) Strategic

You'll be selecting the EDR platform, negotiating contracts, and defining the enterprise endpoint security strategy. You'll ensure your team can conduct advanced threat hunting and respond effectively to endpoint detections.

Tenable.io / Qualys VMDR (Vulnerability Management) Strategic

You'll own the vulnerability management programme, setting remediation SLAs, and reporting on risk reduction to leadership. You'll guide the prioritisation of findings based on business context, not just raw CVSS scores.

Wiz / Palo Alto Prisma Cloud (CSPM/CWPP) Strategic

You'll define the cloud security architecture, set guardrails for development teams, and be responsible for our overall cloud compliance posture. You'll ensure policies are integrated into CI/CD pipelines and complex cloud threats are investigated.

Okta / Azure Active Directory (Entra ID) (IAM) Strategic

You'll own the enterprise identity strategy (e.g., Zero Trust), manage the IAM budget, and report on access risk to leadership. You'll guide the design of SSO/SAML integrations and conditional access policies.

ServiceNow GRC / OneTrust (GRC & Compliance) Strategic

You'll manage the GRC platform, present audit findings to the board, and define the overall compliance strategy. You'll ensure controls are mapped to multiple frameworks and evidence collection is automated where possible.

Palo Alto Networks (Panorama) / Zscaler (Network Security) Strategic

You'll architect the network security and SASE strategy, approve major architectural changes, and manage key vendor relationships. You'll ensure firewall and segmentation policies are robust and security profiles are optimised.

5What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Security Policy Changes Propose changes to supervisor; implement under direct supervision. Propose and draft changes; review with manager before implementation. Lead the drafting and review process; recommend to Director for approval; implement independently.
Incident Response Actions (Critical Incident) Execute pre-defined playbook steps; escalate immediately if unsure. Independently execute playbook; propose deviations to manager; lead minor incidents. Lead complex incident response efforts; make real-time tactical decisions; escalate strategic decisions to Director.
Budget Allocation (within function) No authority; request resources from supervisor. Propose specific tool purchases or training needs to manager. Recommend budget spend for specific projects up to £5K; manage project budget adherence.
Hiring & Team Structure No authority; participate in interviews as a panel member. Provide feedback on candidates; suggest skill gaps to manager. Lead interview panels; make recommendations on candidate suitability; suggest minor team adjustments.
Vendor Selection & Management Research potential tools; provide feature comparisons to supervisor. Evaluate vendor solutions against requirements; participate in vendor demos. Lead vendor evaluation process; recommend preferred vendors; manage relationships for specific tools.

6How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

NIST CSF Maturity Score Improvement
Progress in our NIST Cybersecurity Framework (CSF) maturity across the Identify, Protect, Detect, Respond, and Recover functions.
Target · Improve overall maturity from 'Tier 2: Risk Informed' to 'Tier 3: Repeatable' within 12 months for your managed function.

If your area is 'Detect', you'd aim to move from ad-hoc alert review to a structured process with clear playbooks and defined MTTR targets, showing a measurable increase in your 'Detect' sub-category scores.

Compliance Audit Pass Rate
Maintaining a clean sheet on critical compliance audits relevant to your security function.
Target · Achieve a 100% pass rate on all key compliance audits (e.g., SOC 2 Type II, ISO 27001) for controls under your remit.

Successfully navigate the annual SOC 2 Type II audit with zero findings or observations related to your managed security controls, like incident response or vulnerability management.

Quantifiable Cyber Risk Reduction
Reducing our overall cyber risk, often articulated using frameworks like FAIR, in financial terms.
Target · Reduce quantifiable cyber risk (e.g., Annualised Loss Expectancy) by 15-20% year-over-year for your managed risk areas.

By implementing a new EDR solution and improving patch management, you've reduced the estimated financial impact of a successful ransomware attack by £1M, as validated by our FAIR analysis.

Security Programme Budget Adherence
Managing the allocated budget for your security function effectively.
Target · Operate within +/- 5% of the approved annual budget for your managed security function.

Your SecOps budget for the year was £750K, and you finished the year at £730K, showing efficient resource allocation and cost control.

Mean Time to Respond (MTTR) for Critical Incidents
The average time it takes for your team to fully resolve a critical security incident from initial detection.
Target · Reduce MTTR for critical (Severity 1 & 2) incidents by 25% within 12 months.

After implementing new playbooks and automation, the average MTTR for a critical data exfiltration incident dropped from 4 hours to 3 hours, minimising potential damage.

Team Development & Retention
Building a high-performing, engaged security team that feels supported and has clear growth paths.
  • High team morale scores in internal surveys
  • retention rate above department average
  • observable growth in individual team members' skills and responsibilities
  • positive feedback from direct reports during 1:1s and performance reviews.
Cross-Functional Influence & Collaboration
Your ability to get other teams (Dev, Ops, Product) to buy into and prioritise security initiatives.
  • Security requirements are consistently integrated early into project lifecycles
  • other departments proactively seek your team's input on new initiatives
  • positive feedback from peer managers in other departments about your team's collaborative approach
  • security initiatives are prioritised on shared roadmaps.
Strategic Insight & Communication
Translating complex technical risks and security programme status into clear, actionable insights for senior leadership and the board.
  • Executive leadership consistently understands the business impact of security risks you present
  • your recommendations are adopted
  • board members ask follow-up questions that demonstrate comprehension rather than confusion
  • your reports are concise and focus on 'so what' for the business.
Incident Post-Mortem Quality
The thoroughness and effectiveness of incident reviews, ensuring lessons are learned and acted upon.
  • Post-mortems consistently identify root causes, not just symptoms
  • actionable remediation plans are created and tracked
  • incidents of a similar nature decrease over time due to implemented learnings
  • other teams acknowledge the value of the post-mortem process.

7Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Protecting the Organisation

You get a genuine buzz from knowing your work and your team's efforts are directly safeguarding the company's assets, data, and reputation. It's not just a job; it's a mission to keep us safe.

You feel a sense of accomplishment after successfully closing a critical vulnerability or seeing your team's incident response plan flawlessly executed during a simulated attack.

Building and Mentoring a Strong Team

You thrive on seeing your direct reports grow, develop new skills, and take on more responsibility. You enjoy coaching, unsticking them, and creating a collaborative environment where everyone learns from each other.

You're proud when a junior analyst you've mentored successfully leads a small incident response effort or delivers a complex security report to a senior audience.

Solving Complex, Evolving Problems

The ever-changing threat landscape and the challenge of securing complex, distributed systems genuinely excite you. You love digging into tricky problems and figuring out how to outsmart the attackers.

You enjoy architecting a new cloud security control that addresses a novel threat vector or designing a GRC process that streamlines compliance for multiple frameworks.

What frustrates people
  • The 'Department of No' perception from other teams.
  • Getting critical patches prioritised over new features.
  • Justifying security budget for 'what if' scenarios.
  • Users repeatedly falling for phishing scams despite training.
  • Spending significant time on compliance box-ticking over actual threat mitigation.
  • Discovering unsanctioned 'Shadow IT' systems.
  • Managing an overwhelming volume of low-fidelity security alerts.
What this role does not give you
  • A static, predictable environment with no urgent changes.
  • Complete control over all IT systems and development roadmaps.
  • A role where you only focus on deep technical work without people management.
  • Guaranteed immediate implementation of every security recommendation.
  • A job where you never have to deal with legacy systems or technical debt.

8Who you work with

This role directly shapes our organisation's security resilience and risk profile. You'll be responsible for a significant chunk of our defence strategy, meaning your decisions and your team's performance have a direct line to protecting our revenue, reputation, and customer trust. Get it right, and we operate securely and confidently; get it wrong, and the business faces significant financial and reputational damage.

Inside the business
  • Director of Information Security
  • Head of Infrastructure & Operations
  • Head of Software Development
  • Legal & Compliance Teams
  • Internal Audit
  • Product Leadership
Outside the business
  • External Auditors (e.g., for SOC 2, ISO 27001)
  • Security Vendors and Partners
  • Incident Response Firms (if engaged)
  • Regulatory Bodies (e.g., ICO, FCA)
  • Industry Peers and Information Sharing Groups

9What you need before you start

Not a wish list. The things you would be expected to already have.

  • Proven experience (10+ years) in IT security roles, with at least 3-5 years in a leadership or management capacity.
  • Demonstrable experience managing a team of security professionals, including hiring, mentoring, and performance management.
  • Deep technical expertise across multiple security domains (e.g., SecOps, GRC, Cloud Security, IAM) with a track record of hands-on implementation.
  • Experience developing and implementing security policies, standards, and procedures in a complex enterprise environment.
  • Strong understanding of enterprise risk management principles and experience articulating cyber risk to senior business stakeholders.
  • A track record of successfully leading significant security projects or programmes from conception to completion.
  • Excellent communication and interpersonal skills, with the ability to influence and collaborate effectively across all levels of an organisation.

10What to practise next

Where the job is going, and what to do about it starting this week.

Cloud-Native Security Architecture & DevSecOps

Our infrastructure is increasingly moving to the cloud, and traditional security models just don't cut it. You'll need to understand how to build security directly into cloud-native applications and CI/CD pipelines, making security a part of development, not an afterthought.

Infrastructure as Code (IaC) Security · Container Security (Kubernetes, Docker) · Serverless Security · Policy as Code (PaC) · Cloud Security Posture Management (CSPM) & Cloud Workload Protection Platform (CWPP) Optimisation

  • This week: Have a coffee with our lead cloud architect to understand our current cloud strategy and pain points.
  • This month: Complete an online course on AWS or Azure security fundamentals, focusing on native security services.
  • Month 2: Work with a senior engineer to identify one critical cloud application and map its security controls end-to-end.
  • Month 3: Propose a DevSecOps initiative to integrate security scanning earlier into a development pipeline.

Quick win: Review your CSPM dashboard for critical misconfigurations and work with the engineering team to prioritise fixing the top three.

Advanced Threat Intelligence & Proactive Defence

Reacting to alerts is no longer enough. We need to be more proactive, using advanced threat intelligence to anticipate attacks and harden our defences before they happen. This means moving beyond basic IoCs to understanding adversary TTPs and motivations.

MITRE ATT&CK Framework · Cyber Threat Intelligence (CTI) Lifecycle · Proactive Threat Hunting · Red/Purple Teaming Exercises · Adversary Simulation

  • This week: Subscribe to a couple of leading threat intelligence feeds and review them daily.
  • This month: Organise a 'brown bag' session with your team to discuss a recent, significant cyber attack and its relevance to us.
  • Month 2: Work with your senior analysts to develop a specific threat hunting hypothesis based on recent intelligence.
  • Month 3: Explore options for integrating a new threat intelligence platform or service into our SecOps workflow.

Quick win: Identify one key threat actor or attack technique relevant to our industry and ensure our SIEM has detection rules specifically for it.

11Staying current once you are in

What people here do to keep up
  • Regularly attend industry conferences (e.g., RSA Conference, Black Hat, Infosecurity Europe) to stay current on trends and network with peers.
  • Participate in local cybersecurity meetups or special interest groups to share knowledge and learn from others.
  • Dedicate time each week to reading security research papers, threat intelligence reports, and industry blogs.
  • Pursue advanced certifications relevant to our tech stack or strategic security initiatives.
  • Mentor junior security professionals, as teaching often solidifies your own understanding.

12The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

Ethical AI Governance & Security

As AI becomes embedded in everything we do, from code generation to threat detection, understanding its ethical implications and how to secure AI systems themselves is paramount. Regulators are already looking at this, and we need to be ahead of the curve.

  • AI Bias & Fairness
  • Data Poisoning & Model Inversion Attacks
  • AI Explainability (XAI)
  • AI Policy & Regulation
  • Secure AI Development Lifecycle (SAIDL)

Advanced Cyber Resilience & Business Continuity Integration

It's no longer enough to just prevent breaches; we need to assume they'll happen and focus on how quickly we can recover and continue operations. Security needs to be deeply integrated with business continuity and disaster recovery planning, moving beyond just IT.

  • Cyber Resilience Frameworks
  • Operational Technology (OT) Security
  • Supply Chain Resilience
  • Tabletop Exercises (Advanced)
  • Recovery Time Objectives (RTO) & Recovery Point Objectives (RPO)

13What you’ll use

What you’ll use

Skills this role draws on

Technical

  • NIST Cybersecurity Framework (CSF) Implementation
  • Incident Response (IR) Lifecycle Management
  • Threat Modelling (STRIDE/DREAD)
  • Risk Management Frameworks (NIST RMF / FAIR)
  • Zero Trust Architecture Design & Implementation
  • ISO 27001/27002 ISMS Management

14The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    From Senior Security Engineer

    3-5 years as a Senior Engineer

    Skills to master

    • Moving from individual contributor to team lead, taking ownership of projects, providing technical mentorship, and starting to translate technical risks into business terms.

    You're ready to move on when

    • Successfully led complex security projects from start to finish.
    • Consistently mentored junior team members and helped them grow.
    • Demonstrated ability to influence cross-functional teams without direct authority.
    • Proactively identified and proposed solutions to systemic security issues.
    • Comfortable presenting technical information to non-technical audiences.
  2. 2

    From Lead Security Architect

    2-4 years as a Lead Architect

    Skills to master

    • Shifting from designing solutions to managing the team that implements and operates them, managing budgets, and focusing on people leadership alongside technical strategy.

    You're ready to move on when

    • Designed and implemented enterprise-wide security solutions that are now in production.
    • Established technical standards and best practices for security.
    • Provided informal leadership and guidance to other architects or engineers.
    • Demonstrated strong communication skills with executive-level stakeholders.
    • Expressed a clear interest in people management and team development.
  3. 3

    From GRC Specialist / Consultant

    4-6 years in GRC, including senior roles

    Skills to master

    • Deepening technical understanding of security controls, moving beyond compliance frameworks to practical implementation and operational security management, and leading technical teams.

    You're ready to move on when

    • Successfully managed complex compliance audits (e.g., ISO 27001, SOC 2).
    • Developed and implemented robust security policies and procedures.
    • Demonstrated strong understanding of underlying technical security controls.
    • Proven ability to influence technical teams to adopt secure practices.
    • Experience with risk management frameworks beyond basic qualitative assessments.

15Where this role leads

The long view: This role can lead to Chief Information Security Officer, Head of GRC and Enterprise Risk, or Principal Security Architect.

16Pay and demand

Pay & demand

Typical pay £54,647 a year Source: ONS Annual Survey of Hours and Earnings, 2025 (provisional), under the Open Government Licence v3.0

The figure is the median for full-time employees in the ONS occupation this job title codes to (Cyber security professionals), from the April 2025 survey, about six months old when published, as ASHE always is. It is that occupation's middle, not this role's. Half earn more.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how IT Security Manager is actually changing.

Where it leads

Roles this leads to

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Incident Response, Investigations and Forensics, worked against IT Security Manager.

Incident Response, Investigations and Forensics Level 5

Applied to your work in IT Security Manager

This unit aims to equip learners with an understanding of incident response as a business function, including the operation of Computer Emergency Response Teams (CERTs) and aligned task forces for business continuity, disaster recovery, and crisis management. Learners will also understand how major computer incidents are formally investigated, including evidence gathering and analysis, and the relevant legal and ethical considerations.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

See Your Progress Grow Illustration
IT Security Manager
  • NIST Cybersecurity Framework (CSF) Implementation
  • Incident Response (IR) Lifecycle Management
  • Threat Modelling (STRIDE/DREAD)
  • Risk Management Frameworks (NIST RMF / FAIR)
  • Zero Trust Architecture Design & Implementation
  • ISO 27001/27002 ISMS Management
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

17The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

IT Security Manager is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. Director of Information Security

    3-5 years as an IT Security Manager

    Level 6 (Director/VP)

    • Enterprise Security Programme Management Overseeing all security functions (SecOps, GRC, AppSec, CloudSec).
    • M&A Security Integration Leading security due diligence and integration for mergers and acquisitions.
    • Regulatory Engagement Direct interaction with regulatory bodies and legal counsel on compliance matters.
    • Vendor Strategy & Relationship Management Managing strategic security vendor partnerships at an enterprise level.
Working with AI on the job

Working with AI

Where AI is starting to help

Let's be real: as an IT Security Manager, your plate is always full. From incident response to compliance reports, it feels like there aren't enough hours in the day. But what if you could offload some of that heavy lifting? AI isn't here to replace you; it's here to give you back your most valuable asset: time.

We're not just talking about theoretical AI here. We're talking about practical, real-world applications that security managers like you are already using to streamline operations, get ahead of threats, and free up headspace for strategic thinking. Imagine cutting down on tedious tasks, getting faster insights, and spending more time coaching your team and less time drowning in alerts. That's the power AI offers.

Alert Triage Automation

Use AI-powered Security Orchestration, Automation, and Response (SOAR) platforms to automatically investigate, enrich, and even close low-level security alerts. Think impossible travel, low-severity malware, or routine policy violations. This frees up your human analysts to focus on the complex, high-stakes threats that actually need their brainpower.

Anomaly Detection Acceleration

Leverage AI/Machine Learning models within your SIEM or User and Entity Behaviour Analytics (UEBA) tools. These smart systems can spot subtle patterns of malicious behaviour – like slow data exfiltration or lateral movement – that would be completely invisible to traditional, rule-based detection methods. It's like having a super-powered detective constantly sifting through your logs.

Threat Intel Summarisation

Use AI assistants to quickly ingest and summarise daily threat intelligence feeds, new Common Vulnerabilities and Exposures (CVE) disclosures, and security research blogs. Instead of sifting through mountains of text, you get a concise brief of what's actually relevant to your specific tech stack and threat landscape, saving you hours of reading.

Executive & Policy Drafting

Utilise generative AI to create first drafts of security policies, incident post-mortem reports, or board-level presentations. These tools can translate highly technical findings into clear, business-risk language, giving you a solid starting point and significantly reducing the time it takes to get those critical documents ready for review.

Common questions

Common questions

How do you become an IT Security Manager?

Common routes in include From Senior Security Engineer (3-5 years as a Senior Engineer), From Lead Security Architect (2-4 years as a Lead Architect) and From GRC Specialist / Consultant (4-6 years in GRC, including senior roles). Times vary with prior experience.

Where can an IT Security Manager progress to?

This role can lead on to Director of Information Security (3-5 years as an IT Security Manager), depending on the skills you build.

What new skills matter most for an IT Security Manager?

Increasingly, Ethical AI Governance & Security and Advanced Cyber Resilience & Business Continuity Integration. These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

Read the Zavmo manifesto to understand how you will be taught Meet your tutors

Or try another one

18Where to go from here

Other roles at Level 5

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

 More jobs in technology and data

Stay in the field you know and move sideways rather than up.
If you leave this industry

The skills built as an IT Security Manager apply across almost any industry. Financial services, tech, healthcare and government all need people who can manage risk, handle incidents and lead a security team.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my free Automation Fluency module What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.