Information Security Lead

About the role

The Information Security Governance, Risk, Policy, Framework & Awareness Lead is responsible for designing, implementing and maintaining the organisation's security governance structures. This senior position ensures that cybersecurity is governed, risk‑managed and communicated effectively across the enterprise.

Key responsibilities

• Design and maintain the overall information security governance model, defining roles, forums and escalation paths.
• Lead the security risk management framework, including risk identification, assessment, treatment and reporting.
• Own the lifecycle of security policies, standards, procedures and ensure alignment with legal and regulatory requirements such as NIS2 and GDPR.
• Develop and execute a comprehensive cybersecurity awareness and training programme, including phishing simulations and executive engagement.
• Provide regular reporting to senior leadership and boards on governance effectiveness, risk posture and policy compliance.
• Collaborate with Legal, Compliance, HR and IT to embed security governance into day‑to‑day business activities.

Required profile

• Proven experience setting information security policies and frameworks.
• Experience in technology risk reporting and interaction with enterprise risk and audit committees.
• Strong understanding of regulatory frameworks such as UK CAF, Cyber Security and Resilience Bill, NIS2.
• Confidence engaging senior leadership and communicating complex security concepts.

Required skills