> Markdown version of [/jobs/ext/4533140-penetration-tester](https://www.wearedevelopers.com/jobs/ext/4533140-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Penetration Tester

- **Company:** Barclay Simpson
- **Location:** London, United Kingdom (Remote available)
- **Experience:** Expert
- **Salary:** £143,000 - £156,000
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Microsoft Azure, Software as a Service, Cloud Computing Security, Cyber Security, Identity and Access Management, Zero Trust Network Access, Service-Oriented Architecture, Software Vulnerability Management, Web Applications, Information Security Management System, Cloud Platform System, ISO/IEC 27002
- **Published:** November 3, 2026
- **Apply:** https://www.barclaysimpson.com/job/jem-44432/information-security-grc-lead-iso27001/

## About the Role

We are seeking an experienced ISO 27001 Lead to drive end-to-end implementation and certification across a global organisation. This role will lead the design, build and operationalisation of the ISMS in line with ISO/IEC 27001:2022., * Proven track record leading ISO 27001 certification end-to-end in complex environments.

 * Strong knowledge of ISO/IEC 27001:2022 and ISO 27002:2022.
 * Experience implementing risk management frameworks, ISMS governance and controls.
 * Cloud security familiarity (Azure/M365, AWS, GCP) and core disciplines (IAM, monitoring, incident & vulnerability management).
 * Strong stakeholder engagement and programme delivery capability.

Deliverables

 * Gap assessment report
 * Defined ISMS scope and governance model
 * Implementation roadmap with budget & resource plan
 * Audit-ready documentation and KPI dashboard

Qualifications: ISO 27001 Lead Implementer and/or Lead Auditor.

## Description

* Conduct enterprise-wide ISO 27001:2022 gap assessment
 * Define ISMS scope, context, governance and risk methodology.
 * Develop the risk register, Statement of Applicability (SoA) and risk treatment plans.
 * Deliver a prioritised implementation roadmap including budget, resourcing and timelines.
 * Establish ISMS governance, metrics, management review and audit readiness.
 * Coordinate cross-functionally with Technology, Security, Legal, HR, Procurement and Business Units.