> Markdown version of [/jobs/ext/4651887-information-security-manager](https://www.wearedevelopers.com/jobs/ext/4651887-information-security-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Information Security Manager

- **Company:** Xceptor
- **Location:** London, United Kingdom
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Software as a Service, Cyber Security, Identity and Access Management, Software Vulnerability Management, Data Logging, Information Security Management System, RSA Archer Platform
- **Published:** November 10, 2026
- **Apply:** https://startup.jobs/information-security-manager-xceptor-10724636

## About the Role

* 7-10+ years in information security, GRC, risk, or audit/compliance roles.
 * Experience in SaaS/technology environments.
 * Demonstrable end-to-end ownership of: ISO 27001 certification (not just support), including the internal audit program and management review and SOC 2 audits (Type II strongly preferred).
 * Experience managing information security incidents and advising senior stakeholders.
 * Proven ability to operate autonomously and drive outcomes without a team.
 * A strong evidence-based mindset: you know what auditors look for and how to structure documentation and artefacts accordingly.
 * ISO 27001 clause and Annex A control expertise, with internal audit planning and execution.
 * SOC 2 Trust Services Criteria experience (control design and operating effectiveness).
 * Strong documentation skills (policies, standards, procedures, control narratives).
 * Excellent stakeholder management, communication, prioritisation and programme organisation.
 * Solid understanding of common security controls (IAM, change management, vulnerability management, logging, incident response, BCP/DR, vendor security).

Preferred Experience

 * ISO 27001 Lead Auditor or Lead Implementer, CISSP, CISA, CRISC (or equivalent).
 * Experience in modern tooling (Wiz, Drata/Vanta or similar, GRC platforms).

## Description

* Build and champion and information security and compliance culture across the business.
 * Advise business and senior leadership on security risks, priorities, and decisions.
 * Run periodic information security meetings and maintain governance and reporting: the audit and compliance calendar, risk register, findings tracker, KPIs/KRIs, and regular leadership updates.
 * Maintain our information security policies, standards, and procedures.

ISO 27001

 * Own and operate the ISMS: scope, risk management, Statement of Applicability, policies and standards, management reviews, corrective actions and continual improvement.
 * Plan and manage the internal audit program.
 * Lead external certification audits (Stage 1, Stage 2 and surveillance): auditor management, PBC coordination, evidence presentation and remediation closure.

SOC 2

 * Own scoping and readiness, and maintain the control matrix, control narratives, evidence catalogue and testing calendar.
 * Lead Type I and Type II audits with the CPA firm, ensuring timely, complete, high-quality evidence and responses.

Controls and operations

 * Build an integrated control library that minimizes duplication across ISO 27001 and SOC 2 and keep controls "operating in reality".
 * Drive cross-functional control ownership (Engineering, IT, Product, HR, Finance, Legal, Ops) through clear requirements, timelines and follow-up.
 * Manage information security incidents, from response through to lessons learned.
 * Work with business counterparts on vulnerability management, including prioritization and remediation.

Customer and supplier assurance

 * Help with RFPs, security questionnaires, and due diligence packs.
 * Support supplier security and evidence sharing aligned to our frameworks.

Customer and supplier assurance

 * Help with RFPs, security questionnaires and due diligence packs.
 * Support supplier security and evidence sharing aligned to our frameworks.