Head of Information Security

Head of Information Security

We’re currently looking for an exceptional Head of Information Security to join our team. Reporting directly to the Chief Information Officer (CIO), the Head of Information Security (CISO) will own information and cyber security across the Group, providing clear leadership on cyber risk while working closely with technology and business teams to deliver practical improvements.

As the Group grows and integrates acquired businesses, protecting our clients, colleagues, data and platforms is fundamental. We are looking for a hands-on CISO who can establish a clear view of our security posture, simplify and strengthen controls across the Group and build a proportionate security capability appropriate for a modern FCA-regulated wealth business.

What we’re looking for:

• Senior InfoSec or CISO experience, ideally in a regulated financial services environment
• Deep knowledge of cyber risk, incident response and security frameworks (e.g. ISO 27001, NIST)
• Credibility with regulators - you'll be comfortable in FCA conversations and understand what good looks like from a compliance perspective
• The ability to translate complex security risk into clear board-level communication
• Experience of M&A security due diligence is a strong plus

What you will be doing:

• You'll take ownership of our information security and cyber strategy, setting the framework, building the culture and ensuring we have the controls, processes and expertise to stay ahead of a rapidly evolving threat landscape.
• That includes leading our response to cyber risk, building our relationship with the FCA on security-related matters, and playing an active role in acquisition due diligence, assessing the security posture of businesses we bring into the group.
• You'll lead a dedicated security team and work closely with IT, Risk, Compliance and the wider business to embed security thinking across everything we do.
• Keep up to date with cyber security, technology and industry developments, attending training where appropriate and continuously developing relevant knowledge and skills.
• Establish a clear, evidence-based view of the Group’s current cybersecurity maturity and risk exposure.
• Define and execute the Group information and cybersecurity strategy and roadmap.
• Create a consistent security control environment across businesses brought together through acquisition.
• Own security governance, policies, risk management and reporting.
• Strengthen identity, access, endpoint, infrastructure, cloud, application and data security.
• Establish effective vulnerability management, monitoring, incident response and cyber resilience.
• Own third-party and technology supplier security risk.
• Test our preparedness through exercises, assurance and appropriate independent testing.