Information Security Manager

• Lead the end-to-end implementation of ISO 27001, taking the organisation from initial assessment through to successful accreditation.
• Develop, implement and maintain an Information Security Management System (ISMS), ensuring alignment with ISO 27001 requirements and business objectives.
• Own and drive the organisation’s governance, risk and compliance (GRC) activities, identifying and managing information security and data protection risks.
• Ensure compliance with GDPR, UK data protection legislation and relevant regulatory requirements.
• Develop and maintain information security policies, procedures, risk registers, control frameworks and supporting documentation.
• Conduct gap analyses, risk assessments and internal audits, coordinating remediation activities to address identified weaknesses.
• Prepare the organisation for external audits and certification assessments, working closely with auditors and key stakeholders.

This is a GRC-focused role rather than a hands-on technical security position. The successful candidate will have a proven track record of taking organisations through the ISO 27001 accreditation process from scratch, establishing the necessary frameworks, policies, controls and governance structures to achieve certification and maintain ongoing compliance., * Proven experience implementing ISO 27001 from scratch and successfully taking an organisation through to accreditation. This is a key requirement for the role.

• Strong knowledge of information security governance, risk management and compliance frameworks.
• A solid understanding of GDPR, UK data protection legislation and information governance.
• Experience developing and embedding an ISMS, including policies, procedures, controls and audit processes.
• The ability to engage confidently with senior stakeholders and influence decision-making across the organisation.
• Strong communication, stakeholder management and organisational skills.
• A pragmatic, hands-on approach to building and maintaining compliance frameworks in a complex business environment.

Desirable Experience

• Professional certifications such as CISSP, CISM or ISO 27001
• Experience working within the utilities, infrastructure or construction sectors, particularly in complex project-based environments.
• Experience managing external audits, certification bodies and ongoing ISO 27001 compliance.
• The ability to translate regulatory and compliance requirements into practical, business-focused solutions.