Description
The Senior Manager, Business Information Security assesses, challenges and is responsible for cyber risk across an assigned Data & Analytics portfolio.
Working closely with leadership, product, engineering, technology and central Cyber teams across the assigned portfolio, the role supports the identification, assessment, remediation and ongoing management of cyber risk.
This is a senior, business-facing security role requiring strong technical credibility, sound risk judgement and the ability to communicate effectively at both engineering and executive levels.
Key Responsibilities
Information Security and Cyber Risk Oversight
- Develop and maintain a clear, evidence-based and threat-informed cyber risk profile for the assigned portfolio.
- Be responsible for the security and risk governance of AI used across the assigned portfolio.
- Identify material cyber risks, control weaknesses and remediation opportunities.
- Assess inherent and residual risk.
- Drive proportionate risk treatment.
- Provide accurate cyber risk reporting.
- Help business and technology teams understand their accountability for security risk management.
Technical Security Review and Challenge
- Assess security controls across applications, infrastructure, cloud services and data platforms.
- Evaluate the secure use of AI-enabled tools.
- Review security architecture and solution designs.
- Challenge vulnerability prioritisation and penetration testing findings.
- Review privileged access and identity controls.
- Assess cyber implications of legacy technology.
Threat-Informed Business Risk Management
- Maintain an informed understanding of relevant threat actors.
- Assess how AI changes the threat landscape.
- Work with Cyber Intelligence and Security Operations teams.
- Assess how credible threat activity could exploit weaknesses.
- Translate technical threat scenarios into potential business consequences.
Executive Communication and Decision Support
- Translate complex cyber security topics into clear communication for executive leadership.
- Explain technical issues without unnecessary detail.
- Clearly articulate affected services and outcomes.
- Adapt communication for different audiences.
- Provide balanced advice.
Relationship-Building and Engagement
- Build and maintain trusted relationships with business leadership and central Cyber teams.
- Become a credible and accessible security partner.
- Develop a detailed understanding of the assigned portfolio.
- Establish credibility with engineering teams.
- Work collaboratively with engineers and architects.
Candidate Profile
- An experienced and qualified information or cyber security professional.
- Strong security knowledge and risk judgement.
- Excellent written and verbal communication.
- Proven ability to build trusted relationships.
- Experience in relevant areas such as cloud security or security engineering.