Security Engineer

• Own the Statement of Applicability (SoA), mapping controls to Annex A and ensuring evidence of control design and operating effectiveness.
• Plan and execute the internal audit programme; coordinate surveillance and recertification audits; manage corrective and preventive actions
• Maintain the policy framework (classification, access control, cryptography, secure development, change, supplier security, etc.) with robust document control.
• Own the risk management cycle: identification, assessment, treatment plans, residual risk acceptance, and risk register maintenance.
• Manage the communication of the ISMS with all interested parties including training, processes and documentation to employees, effective reporting of measurement against objectives to senior leadership and responding to client information security questionnaires
• Play a key role in the assessment, review and continuous monitoring of supplier organisations and technology partners
• Maintain the Incident Response Plan and runbooks; lead incident handling, forensics coordination, and postincident reviews.
• Align security with Business Continuity and Disaster Recovery e.g., RPO/RTO requirements, backup/restore testing, resilience of critical suppliers.
• Define and report security KPIs to the Information Security committee e.g., patch compliance, incidents, risks, phishing fail rate, incident metrics, control coverage, audit findings.
• Work with IT, Operations, Engineering and wider business units to help identify risks and to scale good practice.

Information Security Manager

Job Level

About the role

Requirements

Information System Security Officer, ISSO, Hybrid

Information Security Consultant – System and Organization Controls, SOC 1/SOC 2 Compliance

Senior Analyst IT Information Security

PCI QSA Consultant

Information Systems Security Officer, ISSO