Director of Information Security

About UK Biobank

UK Biobank is a large-scale biomedical database and research resource containing in-depth genetic and health information from half a million UK participants.

The database, the largest and most comprehensive of its kind in the world, is anonymised and made widely accessible by UK Biobank to global researchers who use it to find new scientific discoveries about common and life-threatening diseases – such as cancer, heart disease and stroke which strike in mid-later life.

UK Biobank is an innovative organisation with over 350 staff across four sites in the UK that fosters an engaging environment and supports the development of our staff. Our dedicated teams work alongside the world's leading biomedical scientists in our joint mission to improve public health.

Role Overview

At UK Biobank, information security isn't simply about protecting systems, it's about safeguarding one of the world's most valuable health research resources.

Our data is trusted by more than 22,000 approved researchers across over 60 countries, helping advance our understanding of cancer, dementia, cardiovascular disease, mental health and hundreds of other conditions. Protecting that trust while enabling scientific discovery is fundamental to everything we do.

We're entering one of the most significant periods of technology transformation in our history. As we continue to invest in modern cloud platforms, AI-enabled services, new digital capabilities and our £127.6 million headquarters at Manchester Science Park, we're looking for a Director of Information Security to lead the next phase of our information security maturity.

This isn't a role focused on maintaining an established security function.

It's an opportunity to shape and define a world-class capability

Key Responsibilities

As Director of Information Security, you'll report directly to our Chief Technology Officer and provide strategic leadership for information security across UK Biobank. You'll be responsible for ensuring our governance, cyber security, identity management, business continuity, and risk management capabilities continue to evolve alongside an increasingly complex threat landscape.

• Developing, implementing, and creating a comprehensive information security strategy, providing direction and support to ensure effective implementation of security controls.
• Conducting regular risk assessments, audits, tests, and modelling to identify and evaluate vulnerabilities and potential threats.
• Providing regular updates to the executive leadership team and represent information security at board, audit, and governance committees.
• Establishing metrics and enforcing information security policies, procedures, and guidelines aligned with standards and frameworks, particularly ISO27001 and the NCSC Cyber Assessment Framework, as well as regulatory requirements and industry best practices.
• Ensuring that critical data and assets have been identified, classified, and subject to appropriate controls, including for handling, ownership, and destruction.
• Leading the organisation’s response to major cyber incidents, including providing out-of-hours and crisis-level support when required.
• Promoting and communicating a culture of security awareness so all staff understand their role in maintaining information security.
• Managing the Information Security budget, setting investment priorities, and contributing to financial planning.