Own and be accountable for the organisation’s overall security posture.
Ensure alignment with business objectives and public sector expectations.
Lead the implementation, maintenance, and continuous improvement of the ISMS in line with ISO/IEC 27001.
Maintain Cyber Essentials Plus certification, ensuring ongoing compliance with technical controls.
Develop and maintain the Security Management Plan, focusing on resilience, availability, and service continuity.
Provide regular assurance reporting to senior leadership and stakeholders.
Own and maintain the Security Risk Register, ensuring risks are identified, assessed, and managed.
Conduct and support risk assessments, internal audits, and external certification activities.
Ensure compliance with relevant UK regulatory and security requirements, including GDPR.
Act as the primary point of contact for security incidents and lead incident response activities.
Ensure security is embedded in the design and operation of services supporting emergency response.
Develop and deliver targeted security awareness and training programmes.

Proven experience in an information security role within a UK-based organisation, ideally supporting public sector or critical services.
Practical experience with security monitoring and incident response tooling (SIEM/XDR).
Strong working knowledge of ISO/IEC 27001 and experience maintaining an ISMS.
Practical experience with Cyber Essentials / Cyber Essentials Plus certification.
Experience managing security risks, incidents, audits, and compliance activities in operational environments.
Ability to balance strategic leadership with hands-on delivery in a small organisation.
Strong understanding of service resilience, availability, and risk in mission-critical systems.
Excellent communication skills, with the ability to engage both technical and non-technical stakeholders.

Information Security Manager

Key skills