> Markdown version of [/jobs/ext/3667413-head-of-information-security](https://www.wearedevelopers.com/jobs/ext/3667413-head-of-information-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Head of Information Security - **Company:** Endeavour Recruitment - **Location:** London, UK - **Experience:** Expert - **Salary:** £125,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Software System Penetration Testing, User Authentication, Microsoft Azure, Cloud Computing, Cloud Computing Security, Configuration Management, Cyber Security, Computer Networks, Multi-Factor Authentication, Identity and Access Management, Network Security, Remote Access Technology, Cloud Services, Security Information and Event Management, Software Vulnerability Management, Data Logging, Computer Networking Systems, Firewalls (Computer Science), Patch Management, CIS Benchmarks, Vulnerability Analysis - **Published:** October 10, 2026 - **Apply:** https://itjobpro.co.uk/job/head-of-information-security-2 ## About the Role The successful candidate will combine strong hands-on technical experience with the ability to influence senior stakeholders, challenge existing practices constructively and translate complex security issues into clear business priorities., Significant professional experience in information security or cyber security, with a strong foundation in hands-on technical roles. Proven experience securing enterprise network and infrastructure environments. Good knowledge of cloud security, particularly Microsoft Azure and Microsoft 365. Experience with Google Enterprise environments would be advantageous. Strong understanding of identity and access management, authentication, privileged access and access-control principles. Experience in vulnerability management, security monitoring and incident response, including coordinating significant security incidents. A track record of developing or improving security policies, technical standards and operational controls. Experience assessing technical security risks and translating findings into practical business decisions. The ability to communicate security risks and recommendations effectively to senior stakeholders and non-technical audiences. Working knowledge of recognised security frameworks, such as the NIST Cybersecurity Framework, CIS Controls and ISO/IEC 27001. Technical Knowledge, Experience working within an international or multi-site organisation. Experience in a business where intellectual property, data protection and information security are particularly important. A recognised information security or cyber security certification. Relevant certifications are desirable but not essential. Practical experience, technical credibility and the ability to deliver meaningful security improvements are the key priorities., Technically credible, curious and comfortable investigating complex systems and security challenges. Pragmatic, with the ability to distinguish significant risks from lower-priority issues. Commercially aware and able to balance security requirements with cost, usability and operational needs. Confident influencing stakeholders and technical teams without direct management authority. Comfortable challenging established practices constructively and supporting recommendations with evidence. An effective communicator who can engage with both technical specialists and senior business leaders. Calm, methodical and decisive when managing security incidents. Self-sufficient and proactive, while working collaboratively with the wider technology function. ## Description This is a senior individual-contributor position rather than a traditional departmental management role. You will not be responsible for managing a dedicated security team. Instead, you will work closely with infrastructure, technology and external service provider teams, providing technical expertise, setting standards and ensuring security risks are appropriately managed., Develop and maintain the organisation's information and cyber security strategy, including a prioritised roadmap and investment plan. Establish and maintain security policies, standards and technical baselines aligned with recognised industry practices. Review the security of enterprise networks, infrastructure, cloud services, endpoints, applications and identity platforms. Work with technical teams to identify security gaps, agree remediation plans and monitor progress. Provide security architecture guidance for new systems, technology projects, cloud services and infrastructure changes. Drive improvements in identity and access management, including authentication, multi-factor authentication and privileged access. Lead vulnerability management activities, prioritising remediation based on risk and potential business impact. Establish effective security monitoring, threat detection and incident response arrangements. Coordinate responses to significant security incidents, ensuring a calm, structured and effective approach. Assess third-party and supplier security risks and ensure security requirements are considered during procurement. Provide senior management with clear reporting on security risks, priorities and recommended actions. Support audit, insurance, customer and regulatory requirements. Promote security awareness and encourage practical, effective security practices throughout the organisation., The successful candidate should have working knowledge across several of the following areas: Network security: Secure network design, segmentation, firewalls, remote access and secure connectivity. Infrastructure and endpoint security: Server hardening, endpoint protection, endpoint detection and response, and patch management. Cloud and SaaS security: Secure cloud configurations, configuration management and cloud service protection. Identity and access management: Directory services, multi-factor authentication, conditional access and privileged access management. Security monitoring: Logging, SIEM tools and managed detection and response services. Vulnerability management: Vulnerability scanning, penetration testing and remediation planning. Security architecture: Assessing proposed designs and ensuring security is Embedded into technology changes and new projects., Confirmation of your legal right to work in the UK, including visa expiry details where applicable. Confirmation that the hybrid working arrangement is suitable. Your salary expectations. Your current notice period. Your availability to start. Applications will be reviewed against the essential technical requirements and relevant experience.