> Markdown version of [/jobs/ext/4082945-senior-manager-business-information-security](https://www.wearedevelopers.com/jobs/ext/4082945-senior-manager-business-information-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Manager, Business Information Security - **Company:** London Stock Exchange Group - **Location:** London, UK - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Software System Penetration Testing, Cloud Computing Security, Cyber Security, Data Loss, Data Security, Decision Support Systems, Key Management, Cloud Services, Software Vulnerability Management, Data Processing, Technical Debt, Cyber Threat Analysis, Data Analytics, Data Management, CIS Benchmarks, ISO/IEC 27002 - **Published:** October 14, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=1dbf78f90d499880 ## About the Role An experienced and qualified information or cyber security professional, able to operate credibly in a large, sophisticated technology environment. A strong technical background and/or previous consulting experience advising senior team members on complex cyber security or technology risk matters is highly beneficial. * Strong security knowledge and risk judgement, with the ability to understand complex technical topics, challenge assumptions and assess credible threats, attack paths, control weaknesses and business impact. * Excellent written and verbal communication, including the ability to translate complex technical security matters into clear, concise and decision-focused messages for non-technical and senior participants. * Proven ability to build trusted relationships across business leadership, product, engineering and central Cyber, influence across organisational boundaries and maintain productive relationships while providing constructive challenge. * Experience in relevant areas such as cloud, security engineering or operations, architecture, vulnerability management, identity and privileged access, application or data security, resilience and third-party security. * Able to form an independent, evidence-based risk view and communicate exposure, treatment options, recommendations and required decisions. Desirable Certifications * CISSP * CISM * Equivalent industry-recognised technical or security risk qualifications, such as OSCP or OSCE, are beneficial. * Certifications complement, but do not replace, technical credibility, practical risk judgement and executive communication capability. Knowledge * NIST Cybersecurity Framework * ISO 27001 and ISO 27002 * CIS Controls * Relevant regulations such as DORA * Security architecture principles * Cyber threat and attack-path analysis * Cloud security and cyber resilience * Cyber risk management and control assurance * Regulatory expectations in a highly regulated financial services environment * Knowledge of, and a strong interest in, AI technologies and their security, risk and business implications will be highly beneficial. ## Description The Senior Manager, Business Information Security assesses, challenges and is responsible for cyber risk across an assigned Data & Analytics portfolio. The assignment may change in line with business priorities, organisational needs and the role holder's experience. Working closely with leadership, product, engineering, technology and central Cyber teams across the assigned portfolio, the role supports the identification, assessment, remediation and ongoing management of cyber risk. The role helps ensure that security capabilities are deployed effectively, controls remain fit for purpose and material risks remain within LSEG's risk appetite. This is a senior, business-facing security role requiring strong technical credibility, sound risk judgement and the ability to communicate effectively at both engineering and executive levels. The role builds trusted relationships across business, engineering and central Cyber, aligns collaborators around material risks and enables effective security outcomes. The successful candidate must translate complex technical security issues into clear business exposure, impact, treatment options and decisions. They must also understand relevant threat actors, motivations and techniques, and how credible attack paths could affect the assigned portfolio, its information assets, customers and broader business outcomes. Key Responsibilities Information Security and Cyber Risk Oversight * Develop and maintain a clear, evidence-based and threat-informed cyber risk profile for the assigned portfolio. * Be responsible for the security and risk governance of AI used across the assigned portfolio, ensuring business adoption is appropriately assessed, controlled and aligned with LSEG requirements. * Identify material cyber risks, control weaknesses and remediation opportunities, ensuring treatment plans are owned, prioritised and tracked to completion. * Assess inherent and residual risk, considering threat relevance, control effectiveness, business impact and risk appetite. * Drive proportionate risk treatment by communicating exposure, options, recommendations and decision consequences, with acceptance considered only where other strategies are inappropriate. * Provide accurate cyber risk reporting, key risk indicators and management information. * Help business and technology teams understand their accountability for security risk management and remediation. Technical Security Review and Challenge * Assess security controls across applications, infrastructure, cloud services, data platforms and third-party services. * Evaluate the secure use of AI-enabled tools, including their effectiveness, limitations, data handling and impact on control design and security operations. * Review security architecture, solution designs and material technology changes to identify security risks, control gaps and attack paths. * Challenge vulnerability prioritisation, penetration testing findings, severity ratings, remediation plans and risk treatment decisions. * Review privileged access, identity controls, service accounts, workload identities, secrets management, exceptions and compensating controls. * Assess cyber implications of legacy technology, technical debt, obsolescence and major transformation initiatives. * Provide practical, proportionate and risk-based recommendations that protect LSEG while enabling delivery. Threat-Informed Business Risk Management * Maintain an informed understanding of relevant threat actors, motivations, capabilities and techniques. * Assess how AI changes the threat landscape, including AI-enabled attack techniques, threats to AI systems and emerging risks relevant to the assigned portfolio. * Work with Cyber Intelligence and Security Operations teams to understand threats relevant to the assigned portfolio. * Assess how credible threat activity could exploit weaknesses or combined control gaps to create material attack paths. * Translate technical threat scenarios into potential business consequences, including service disruption, data loss or compromise, customer impact, regulatory or contractual exposure, financial loss and reputational harm. * Use threat information to influence risk prioritisation, control investment and remediation decisions. * Help leadership distinguish between theoretical technical weaknesses and credible, material business risk. Executive Communication and Decision Support * Translate complex cyber security topics into clear, concise and decision-focused communication for executive leadership. * Explain technical issues without unnecessary detail while preserving the substance and severity of the risk. * Clearly articulate affected services and outcomes, threats and attack paths, controls and weaknesses, inherent and residual risk, treatment options, recommendations and required decisions. * Adapt communication for executive, risk, product, engineering, audit and regulatory audiences. * Provide balanced advice that supports informed decisions rather than relying solely on compliance statements or technical severity ratings. * Communicate uncertainty, assumptions and evidence limitations clearly. Relationship-Building and Engagement * Build and maintain trusted, effective relationships with business leadership, product teams, engineering teams and central Cyber across the assigned portfolio. * Become a credible and accessible security partner who is engaged early in business, product and technology decisions. * Develop a detailed understanding of the assigned portfolio's strategy, services, technology environment, delivery priorities and business objectives. * Establish credibility with engineering teams through technical understanding, pragmatic advice and consistent follow-through. * Work collaboratively with engineers and architects to translate security requirements into practical, sustainable technical outcomes. * Maintain a partnership-first relationship with central Cyber, aligning the assigned portfolio with Group strategy, policies, standards and capabilities. * Represent the assigned portfolio's business and engineering context clearly to central Cyber without weakening Group security requirements. * Align business, engineering and central Cyber partners on material risks, accountabilities, treatment plans and decisions. * Influence outcomes across organisational boundaries without relying solely on formal authority. * Challenge decisions and raise material risk with independence and sound judgement while preserving productive relationships.