Tillo

Security Engineer

• Own the ISMS documentation and audit programme, coordinate internal and external audits, oversee the risk register, and support internal teams on policy compliance and security awareness
• Maintain and evolve the ISMS documentation and controls in line with ISO 27001:2022
• Coordinate and lead internal audits (quarterly for TZ) and external certification audits
• Write up audit findings and risk reports for SLT and the Board
• Monitor ISMS KPIs and compliance metrics
• Own the company-wide risk register and associated documentation
• Support teams in identifying, assessing, and documenting risks
• Track and ensure timely implementation of Risk Treatment Plans
• Maintain the incident log, ensuring proper documentation, root cause analysis and closure
• Drive corrective actions and improvements from internal/external audits and incidents
• Maintain and develop ISO 27001-compliant security policies (non-Engineering)
• Coordinate business-wide security awareness training (e.g., KnowBe4)
• Champion InfoSec awareness and lead monthly security meetings
• Complete InfoSec and risk sections of client due diligence questionnaires
• Support the development of a Trust Centre to streamline security responses

Information Security Manager