GAIN Central IT - Information Security Manager

Main Responsibilities :

The Information Security Manager is responsible for proactively managing and improving our Information Security Management System driving risk reduction and security maturity across the organisation, partnering with IT, Engineering, Legal, Procurement, and senior leadership.

• Own the Statement of Applicability (SoA), mapping controls to Annex A and ensuring evidence of control design and operating effectiveness.
• Plan and execute the internal audit programme; coordinate surveillance and recertification audits; manage corrective and preventive actions
• Maintain the policy framework (classification, access control, cryptography, secure development, change, supplier security, etc.) with robust document control.
• Own the risk management cycle : identification, assessment, treatment plans, residual risk acceptance, and risk register maintenance.
• Manage the communication of the ISMS with all interested parties including training, processes and documentation to employees, effective reporting of measurement against objectives to senior leadership and responding to client information security questionnaires
• Play a key role in the assessment, review and continuous monitoring of supplier organisations and technology partners
• Maintain the Incident Response Plan and runbooks; lead incident handling, forensics coordination, and postincident reviews.
• Align security with Business Continuity and Disaster Recovery e.g., RPO / RTO requirements, backup / restore testing, resilience of critical suppliers.
• Define and report security KPIs to the Information Security committee e.g., patch compliance, incidents, risks, phishing fail rate, incident metrics, control coverage, audit findings.
• Work with IT, Operations, Engineering and wider business units to help identify risks and to scale good practice.

Professional skills / experience :

Personal Qualities