Information Security Manager

• Build and champion and information security and compliance culture across the business.
• Advise business and senior leadership on security risks, priorities, and decisions.
• Run periodic information security meetings and maintain governance and reporting: the audit and compliance calendar, risk register, findings tracker, KPIs/KRIs, and regular leadership updates.
• Maintain our information security policies, standards, and procedures.

ISO 27001

• Own and operate the ISMS: scope, risk management, Statement of Applicability, policies and standards, management reviews, corrective actions and continual improvement.
• Plan and manage the internal audit program.
• Lead external certification audits (Stage 1, Stage 2 and surveillance): auditor management, PBC coordination, evidence presentation and remediation closure.

SOC 2

• Own scoping and readiness, and maintain the control matrix, control narratives, evidence catalogue and testing calendar.
• Lead Type I and Type II audits with the CPA firm, ensuring timely, complete, high-quality evidence and responses.

Controls and operations

• Build an integrated control library that minimizes duplication across ISO 27001 and SOC 2 and keep controls “operating in reality”.
• Drive cross-functional control ownership (Engineering, IT, Product, HR, Finance, Legal, Ops) through clear requirements, timelines and follow-up.
• Manage information security incidents, from response through to lessons learned.
• Work with business counterparts on vulnerability management, including prioritization and remediation.

Customer and supplier assurance

• Help with RFPs, security questionnaires, and due diligence packs.
• Support supplier security and evidence sharing aligned to our frameworks.

Customer and supplier assurance

• Help with RFPs, security questionnaires and due diligence packs.
• Support supplier security and evidence sharing aligned to our frameworks.

• 7-10+ years in information security, GRC, risk, or audit/compliance roles.
• Experience in SaaS/technology environments.
• Demonstrable end-to-end ownership of: ISO 27001 certification (not just support), including the internal audit program and management review and SOC 2 audits (Type II strongly preferred).
• Experience managing information security incidents and advising senior stakeholders.
• Proven ability to operate autonomously and drive outcomes without a team.
• A strong evidence-based mindset: you know what auditors look for and how to structure documentation and artefacts accordingly.
• ISO 27001 clause and Annex A control expertise, with internal audit planning and execution.
• SOC 2 Trust Services Criteria experience (control design and operating effectiveness).
• Strong documentation skills (policies, standards, procedures, control narratives).
• Excellent stakeholder management, communication, prioritisation and programme organisation.
• Solid understanding of common security controls (IAM, change management, vulnerability management, logging, incident response, BCP/DR, vendor security).

Preferred Experience

• ISO 27001 Lead Auditor or Lead Implementer, CISSP, CISA, CRISC (or equivalent).
• Experience in modern tooling (Wiz, Drata/Vanta or similar, GRC platforms).

Data is at the heart of everything we do: Xceptor has been designed around data manipulation in its broadest sense. We source data from wherever it flows. We curate, normalise, validate, repair, and enrich that data so it reaches its destination in a reliable and consistent format. Data coming out of Xceptor is data our clients can trust.

We are recognised as an expert in the Financial Services vertical, which strongly aligns with Business Users in Middle and Back-Office teams. We enable these users to solve their data challenges by themselves, rather than through a technology-led project.

Our mission - we empower business users within financial institutions to build automated processes that deliver trusted data.

Our values sit at the heart of our business, driving who we are and how we work. At Xceptor, we are:

• Client Centric; we prioritise our Clients’ experience and needs.
• One Team; we actively support one another to achieve our goals.
• Impactful; we focus, we innovate, we make every minute matter., We believe great ideas come from everywhere - and that the best teams are made up of people with different backgrounds, experiences, and perspectives. At Xceptor, we’re committed to building a workplace where everyone feels welcome, valued, and empowered to be themselves.