Information Security Solutions

Title Cyber Advisory Lead Reference No 2162 Company FTSE 100 Reports to Cyber Advisory Services Manager Location London Working Pattern 37.5 hours per week, Monday - Friday. Location: London/Peterborough, with potential travel to divisional sites as required by advisory engagements (hybrid working arrangements in place). Salary £59,000 - £72,000 Benefits Bupa, Matched pension contributions. Group Cyber Security Overview The Group Cyber Security (GCS) team is responsible for managing cyber risk appropriately across the Group and has recently refreshed its cyber strategy, with a renewed focus on embedding cyber security as part of the culture and DNA. The Group operates a highly federated business model spanning 11 divisions and over 50 countries, and the cyber strategy has been designed to build materially improved security capabilities whilst working with a divisional focus. It is an exciting time to join GCS. We are in a period of significant investment, with a multi year transformation programme underway to build new security capabilities at pace. GCS sets the Group cyber standard, measures compliance against it across all the businesses, and delivers a portfolio of centrally managed security services that divisions can rely on. The Cyber Advisory Services function is the critical bridge between Group standards and divisional reality - translating GCS expertise into practical, context sensitive support that helps divisions understand, adopt, and embed the Group cyber standard in their specific environments. Role Summary Reporting to the Cyber Advisory Services Manager, the Cyber Advisory Lead is a senior individual contributor and the primary delivery resource within the advisory function. The role provides expert cyber security advice and guidance directly to the divisions, business units, and Group functions - operating as a trusted consultant who helps translate Group cyber standards into practical action on the ground. The Cyber Advisory Lead is the person divisions call when they need a credible, knowledgeable partner to work through a cyber security challenge with them: someone who understands both the Group standard and the operational reality of divisional environments. The role delivers a wide range of advisory services including technical standards interpretation and guidance, firewall rule base and security policy review, security input to non functional requirements for Group and divisional programmes, and advisory support to merger, acquisition, and divestiture activity. The Cyber Advisory Lead also plays a key role in managing and briefing flexible resources drawn from the GCS resourcing pool, ensuring they are deployed effectively and maintain the quality standards expected of the advisory function. This is a hands on role that demands breadth, consulting confidence, and the ability to calibrate advice to the needs and maturity of each divisional audience. Role Responsibilities / Accountabilities Technical Standards Advisory & Interpretation Act as the primary advisory point of contact for divisions and business units seeking guidance on the interpretation and application of Group cyber technical standards; provide clear, practical, and risk proportionate advice that helps divisions understand what compliance looks like in their specific environment. Translate Group technical standards into actionable divisional guidance; develop worked examples, implementation notes, and practical toolkits that make standards easier for divisional IT and security teams to adopt without losing the intent of the underlying requirement. Capture intelligence from advisory engagements - recurring questions, implementation blockers, divisional gaps - and feed it back to the Cyber Advisory Services Manager to inform improvements to standards, guidance materials, and the advisory service offering. Rule Base Assessment & Security Policy Review Plan and conduct firewall rule base reviews and security policy assessments for Group and divisional environments; identify technical debt, overly permissive rules, obsolete entries, and configuration drift, and produce clear, risk prioritised findings reports with actionable remediation guidance. Review and assess security policy change requests from divisions, evaluating proposed changes against Group standards and architectural principles and providing a clear recommendation with supporting rationale; act as a constructive challenge function rather than a bureaucratic gate. Support divisional teams in understanding and implementing remediation actions following rule base and policy reviews; track agreed actions to closure and provide follow up assurance that improvements have been embedded sustainably. Non Functional Security Requirements Engage with Group and divisional programme teams to define and validate non functional security requirements (NFRs); ensure that security properties - covering authentication, authorisation, encryption, logging, resilience, and data classification - are specified clearly and in a form that project and engineering teams can act on. Apply the Group NFR library to programme and project engagements, tailoring standard requirements to the specific technology context; identify where project proposals deviate from Group security expectations and work with project teams to find compliant or risk accepted alternatives. Contribute to the ongoing development and maintenance of the Group NFR library; identify gaps, outdated requirements, and emerging security considerations that should be reflected in standard NFR content. M&A, Project & Programme Advisory Support Provide cyber security advisory input to merger, acquisition, and divestiture activity, supporting the Cyber Advisory Services Manager in delivering the GCS M&A workstream; conduct cyber due diligence assessments, identify security risks associated with target entities, and develop recommendations for integration or separation. Support the delivery of cyber advisory input to Group and divisional strategic programmes - including technology transformations, cloud migrations, and ERP deployments - ensuring security considerations are raised and addressed at the right stage of each programme lifecycle. Produce high quality advisory outputs - reports, briefing notes, findings summaries, and recommendations - that reflect well on GCS and provide divisional stakeholders with clear, actionable intelligence. Flexible Resource Management & Divisional Engagement Support the Cyber Advisory Services Manager in managing the GCS flexible resourcing pool; brief and onboard flexible resources ahead of divisional deployments, maintain quality standards throughout engagements, and provide day to day direction to consultants and contractors working within the advisory function. Build and maintain trusted working relationships with divisional security leads, IT directors, and BISOs; position yourself as an accessible, credible, and practically minded partner who divisions want to engage with rather than a compliance overhead. Act as an active intelligence gatherer during divisional engagements; identify common challenges, recurring themes, and emerging risks across the estate, and feed structured insight back to the Cyber Advisory Services Manager and the wider GCS Leadership Team. Experience, Knowledge, Skills & Attributes Essential Experience 6+ years in cyber security, with a significant portion in advisory, consulting, or technical security roles requiring breadth across multiple domains. Demonstrable experience delivering cyber security advisory services to business units or divisions within a large organisation, or to enterprise clients as an external consultant. Hands on experience conducting firewall rule base reviews and security policy assessments, producing structured findings reports with risk prioritised recommendations. Experience defining or reviewing non functional security requirements for technology programmes, and the ability to translate security standards into specific, measurable project requirements. Experience providing cyber security input to M&A or other major business change programmes, including due diligence support and integration planning. Knowledge & Skills Broad technical knowledge spanning the core cyber security domains - network security, identity and access management, endpoint protection, cloud security, application security, and data protection - sufficient to advise credibly across all of them. Strong consulting and communication skills: able to listen carefully, form a well reasoned view, and articulate it clearly - whether in a written advisory report, a divisional workshop, or a one to one conversation with a BISO or IT director. Ability to translate Group technical standards into practical, context sensitive guidance that maintains the intent of the standard while acknowledging legitimate operational constraints of the division. Strong written output skills; able to produce high quality advisory reports and briefing materials that are accurate, clearly structured, and appropriate for a senior divisional or Group audience. Qualifications Degree level education in computer science, information security, or a related discipline; or equivalent professional experience. Professional certification in cyber security: CISSP, CISM, CompTIA Security+, or equivalent demonstrating technical breadth. Experience within a Big Four, specialist cyber consultancy, or in house advisory function of a large FTSE listed organisation . click apply for full job details

Information Security Solutions is seeking a Cyber Advisory Lead to provide expert cyber security guidance across divisions. This senior role involves interpreting technical standards and conducting firewall reviews, ensuring compliance in diverse environments. With a focus on developing actionable guidance and managing advisory resources, the ideal candidate will possess extensive experience in cyber security. Flexible hybrid working options are provided, along with competitive salary and benefits.

Overview Title: Cyber Platform Engineer Reference No: 2160 Company: FTSE 100 Reports to: Security Platform Engineering Manager Location: London Working Pattern: 37.5 hours per week, Monday - Friday. Location: London/Peterborough, with potential travel to divisional sites as required by advisory engagements (hybrid working arrangements in place). Salary: £59,000 - £72,000 Benefits: Bupa, Matched pension contributions. The Role Group Cyber Security Overview The Group Cyber Security (GCS) team is responsible for managing cyber risk appropriately across the Group and has recently refreshed its cyber strategy, with a renewed focus on embedding cyber security as part of the culture and DNA. This is a highly federated business model spanning 11 divisions and over 50 countries, and the cyber strategy has been designed to build materially improved security capabilities whilst working with a divisional focus. It is an exciting time to join GCS. We are in a period of significant investment, with a multi-year transformation programme under way to build new security capabilities at pace. GCS is responsible for setting the Group cyber standard, measuring compliance against it across all the businesses, and delivering a portfolio of centrally managed security services that divisions can rely on. The Security Platform Engineering function is central to that portfolio - responsible for ensuring that the security tools the Group invests in are deeply understood, expertly configured, continuously improved, and consistently delivering their intended security and business value. Role Summary Reporting to the Security Platform Engineering Manager, the Cyber Platform Engineer is a hands-on technical specialist responsible for the day-to-day engineering, configuration, and operational health of one or more security platforms within the GCS portfolio. The role sits at the technical heart of the platform engineering function - doing the detailed, expert work that keeps the security tools performing at their best, configured to the right standards, and evolving in line with the Group's needs and the vendor's roadmap. The platforms in scope include Microsoft Defender (across the M365 Defender suite), Zscaler, Qualys, Abnormal Security, and Axonius. The Cyber Platform Engineer will typically own deep expertise in one or two of these platforms and maintain solid working knowledge across the others. The role shares the mindset that defines the whole function: genuine curiosity about the tools under its care, a desire to understand and exploit their full capability, and an instinct to identify where existing platform features can be applied creatively to address new problems rather than defaulting to new tooling. The Cyber Platform Engineer works closely with the SOC and security operations teams to ensure platforms are tuned for effective detection and response, and provides technical support and configuration guidance to divisional IT and security teams who are deploying or operating centrally managed platforms in their environments. Role Responsibilities / Accountabilities Platform Engineering & Technical Configuration Own the technical configuration and day-to-day engineering of assigned platforms within the GCS portfolio; maintain configurations to the approved baseline, apply updates and changes through the change management process, and ensure platform health is actively monitored and maintained. Develop and maintain detailed configuration documentation, runbooks, and change records for assigned platforms; ensure that configuration state is consistently documented, version-controlled, and auditable by the Security Platform Engineering Manager or by assurance functions. Utilising the Run team - Identify and implement improvements to platform configurations that improve security outcomes, reduce operational noise, or unlock additional capability; bring well-evidenced proposals to the Security Platform Engineering Manager for review before implementation. Maintain deep, current technical knowledge of assigned platforms; stay ahead of vendor releases, patch notes, and roadmap updates, and flag relevant developments to the Security Platform Engineering Manager with a view on their implications. Policy Configuration & Standards Alignment Translate Group cyber technical standards into platform-level policy configurations; ensure that policy settings in assigned platforms enforce the correct security controls, are consistently applied across all in-scope environments, and align with the Group cyber enterprise architecture. Identify and report divergence between the approved configuration baseline and the as-built state of assigned platforms; investigate root causes, assess risk, and work with the Security Platform Engineering Manager to agree and implement remediation. Provide technical configuration guidance to divisional IT and security teams deploying or operating centrally managed platforms in their environments; act as the technical point of contact for platform-specific queries, ensuring divisional implementations meet Group standards. SOC Support & Operational Tuning Work closely with the SOC and security operations teams to tune platform configurations for effective detection and response; adjust detection rules, alert thresholds, and data feeds in response to operational feedback, ensuring SOC analysts receive high-fidelity, actionable alerts. Act as the technical escalation point for platform-related operational issues raised by the SOC; diagnose platform problems, engage vendor support where required, and drive issues to resolution with minimal impact on SOC operational effectiveness. Develop and maintain platform integration configurations that connect assigned platforms to the SIEM, SOAR, and other operational tooling; ensure data feeds are reliable, well-formed, and provide the SOC with the visibility needed to detect and respond to threats effectively. Platform Capability Development & Innovation Actively explore the full capability of assigned platforms; identify licensable features, beta capabilities, and underused functionality that could improve the security posture, and bring well-structured proposals to the Security Platform Engineering Manager for consideration. Design and implement automation and integration workflows that improve the efficiency and effectiveness of platform operations; develop scripts, API integrations, and orchestration logic that reduce manual effort and enable platform capabilities to be delivered at scale. Support the delivery of platform deployments, upgrades, and new capability rollouts as part of the GCS transformation programme; plan and execute engineering work with precision, minimising disruption to the business and to SOC operations throughout. Vendor Engagement & Licence Management Maintain productive working relationships with vendor technical teams for assigned platforms; engage effectively with vendor support for issue resolution, participate in technical briefings and product roadmap sessions, and escalate product deficiencies through appropriate channels. Maintain accurate records of licence entitlements, feature adoption, and consumption for assigned platforms; flag any discrepancies, unused entitlements, or upcoming renewal milestones to the Security Platform Engineering Manager in a timely manner. Experience, Knowledge, Skills & Attributes Essential Experience 4+ years in a cyber security engineering or security operations technology role, with hands-on technical experience configuring and managing enterprise security platforms. Demonstrable, deep technical expertise in at least one platform from the portfolio - Microsoft Defender / M365 Defender suite, Zscaler, Qualys, Abnormal Security, or Axonius - including hands-on configuration, policy management, and operational tuning at enterprise scale. Experience working closely with a SOC or security operations team, with an understanding of how platform configuration decisions affect detection quality, alert fidelity, and analyst workflow. Experience maintaining configuration documentation and operating within a structured change management process for security platforms. Experience engaging with vendor technical support teams, logging and escalating issues effectively, and driving platform problems to resolution. Knowledge & Skills Genuine technical curiosity: the instinct to explore platforms beyond surface-level familiarity, understand their full capability depth, and think creatively about how features can be applied to solve real security problems. Strong working knowledge of the Microsoft security stack, including Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, Defender for Office 365, and M365 security policy configuration. Understanding of security platform integration patterns, including API connectivity, SIEM/SOAR data feeds, and log forwarding; practical experience implementing or maintaining at least one such integration. Ability to produce clear technical documentation - configuration records, runbooks, change requests - to a consistent and auditable standard. Qualifications Degree-level education in computer science, information security, or a related technical discipline; or equivalent professional experience. Vendor certification in at least one of the platforms in scope (e.g . click apply for full job details

Information Security Solutions is seeking a Cyber Architecture Manager to lead the Group's cyber enterprise architecture. Located in London, this role emphasizes optimizing security across 11 divisions globally. The successful candidate will ultimately shape the security technology opportunities for the Group while supporting significant investments in transformation initiatives. Must have over ten years of IT security experience and strong architectural background. Hybrid work options available.

Information Security Solutions is seeking a Cyber Security Platform Engineer to manage the Microsoft security platform. The role entails ensuring the effective configuration and management of security tools and assessing current states against best practices. Ideal candidates will have over 5 years in cyber security, strong proficiency in M365 Defender, and Microsoft Entra ID security configurations. The position offers a hybrid work model with significant potential for career growth.

Information Security Solutions is seeking a Cyber Platform Engineer to focus on the engineering and operational health of security platforms. The role involves close collaboration with the Security Platform Engineering Manager and SOC teams to ensure effective security deployment. Candidates should have 4+ years in cyber security, proven experience with Microsoft Defender or similar platforms, and possess strong technical curiosity. This position offers hybrid working arrangements and a competitive salary of £59,000 to £72,000, alongside benefits like Bupa and matched pension contributions.

Overview Title: Cyber Security Platform Engineer - Microsoft Reference No: 2161 Company: FTSE 100 Reports to: Security Platform Engineering Manager Location: London Working Pattern: 37.5 hours per week, Monday - Friday. Location: London/Peterborough, with potential travel to divisional sites as required by advisory engagements (hybrid working arrangements in place). Salary: £59,000 - £72,000 Benefits: Bupa, Matched pension contributions. The Role Group Cyber Security Overview The Group Cyber Security (GCS) team is responsible for managing cyber risk appropriately across) the Group and has recently refreshed its cyber strategy, with a renewed focus on embedding cyber security as part of the culture and DNA. This is a highly federated business model spanning 11 divisions and over 50 countries, and the cyber strategy has been designed to build materially improved security capabilities whilst working with a divisional focus. It is an exciting time to join GCS. We are in a period of significant investment, with a multi-year transformation programme under way to build new security capabilities at pace. GCS is responsible for setting the Group cyber standard, measuring compliance against it across all the businesses, and delivering a portfolio of centrally managed security services that divisions can rely on. The Security Platform Engineering function is central to that portfolio - responsible for ensuring that the security tools the organisation invests in are deeply understood, expertly configured, continuously improved, and consistently delivering their intended security and business value. Microsoft is the most strategically significant security platform, and the uplift and optimisation of the Microsoft security estate is one of the most consequential engineering challenges in the GCS transformation programme. Role Summary Reporting to the Security Platform Engineering Manager, the Cyber Security Platform Engineer - Microsoft is the Group dedicated technical authority for the Microsoft security platform. The role carries implied ownership of the full Microsoft security stack: the M365 Defender suite, the security-relevant capabilities of Microsoft Entra ID (conditional access, Privileged Identity Management, access packages, and least privilege), Intune, and the foundational configuration of the Microsoft 365 and Azure environments on which all of these depend. This is a role that extends beyond BAU platform management: a significant part of the initial mandate is to critically assess the current state of the Microsoft estate - spanning E3, Active Directory, Entra ID, Intune, and existing Defender deployments - identify the gaps against vendor-recommended best practice and the Group cyber standard, and build a prioritised strategy and plan to close them. This role is the primary technical owner of that relationship on the GCS side - working directly with the Microsoft team to prioritise, plan, and drive the E5 deployment across the estate, and ensuring that the professional services and engineering resources available are directed at the highest-value activities. The role must navigate the realities of the federated organisation with skill: delivery will depend on partnership with divisional IT teams, and getting there will require excellent stakeholder management, a clear change communication approach, and an absolute commitment to end-user experience. Zero tolerance for avoidable downtime is not a preference - it is a non-negotiable operating constraint. The role works in close partnership with the Cyber Architecture Manager, the Group CTO function, the IT Frameworks Director, Assurance leads, Divisional Security Leads, and the Identity Transformation team. It shares the defining mindset of the whole platform engineering function: genuine passion for the Microsoft platform, curiosity about its full capability, and the drive to get to a secure, consistent, vendor-recommended configuration as quickly and as safely as possible. Role Responsibilities / Accountabilities Microsoft Estate Assessment, Gap Analysis & Strategy Conduct a structured, critical assessment of the current Microsoft security estate, covering Active Directory, Microsoft Entra ID, Intune, M365 (E3 and current Defender deployments), and Azure security configuration; benchmark the current state against Microsoft's secure score recommendations, vendor best practice, and the Group cyber technical standard, and produce a clear, evidence-based gap analysis. Develop a prioritised Microsoft security uplift strategy and delivery plan that sequences remediation and enhancement activity by risk reduction impact, operational feasibility, and alignment with the E5 migration roadmap; ensure the plan is realistic for federated environment and has clear milestones, owners, and success criteria. Maintain the Microsoft security uplift plan as a live document; track progress against milestones, report status to the Security Platform Engineering Manager, and adapt the plan to the Groups environment, the threat landscape, and the Microsoft product roadmap evolve. Microsoft Defender Platform Ownership & Engineering Own the technical configuration, ongoing engineering, and operational health of the full M365 Defender suite, including Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, Defender for Office 365, and Microsoft Sentinel integration; maintain configurations to the approved baseline and drive continuous improvement against vendor-recommended configuration. Work closely with the SOC to tune Defender configurations for effective detection and response; adjust detection rules, custom detection queries, and alert thresholds in response to SOC operational feedback, ensuring analysts receive high-fidelity, actionable alerts with minimal noise. Develop and maintain detailed configuration documentation, runbooks, and change records for all Defender workloads; ensure configuration state is consistently documented, version-controlled, and auditable. Entra ID Security & Identity Controls Own the security configuration of Microsoft Entra ID across the Group; take implied technical ownership of the security-relevant Entra capabilities including Conditional Access policy design and enforcement, Privileged Identity Management (PIM), access packages and entitlement management, Identity Protection, and the application of least privilege principles across the directory. Work with the Cyber Architecture Manager, the IT Frameworks Director, and Assurance leads to ensure that GCS policies - including BYOD, remote access, and privilege management policies - are correctly and completely manifested in Entra Conditional Access policies and Intune device compliance rules; maintain a clear mapping between policy intent and platform configuration. Support the Active Directory to Entra ID modernisation journey; identify legacy AD configurations and hybrid identity risks that need to be addressed as part of the E5 migration, and work with the Identity Transformation team to ensure Entra security configuration activity is co-ordinated with the broader identity programme. Own the Intune security configuration, maintain device compliance policies, configuration profiles, and security baselines; ensure Intune is configured to enforce the Group endpoint security standard and provides accurate device compliance data to Entra Conditional Access and the Defender estate. E5 Migration, ECIF Engagement & Microsoft Relationship Act as GCS's primary technical liaison to the Microsoft ECIF (Engineering Co-Investment Fund) team; plan, prioritise, and drive the E5 deployment programme in partnership with the ECIF team, ensuring that Microsoft engineering resources are directed at the highest-value activities and that the Organisation is getting the maximum benefit from the co-investment engagement. Manage the technical relationship with Microsoft across the security and identity platform; maintain active engagement with Microsoft technical account management, product specialists, and engineering teams; use the account relationship to gain early access to roadmap briefings, preview features, escalation paths, and best-practice guidance relevant to the organisations environment. Plan and manage the technical delivery of E5 capability rollout across the divisions; sequence deployment activity to maximise early security value, sequence it safely within the change management constraints, and ensure each phase is fully tested, documented, and supported before moving to the next. Maintain accurate records of Microsoft licence entitlements, feature adoption, and E5 deployment progress; ensure the Group is consuming the capabilities it is paying for, and provide the Security Platform Engineering Manager with clear, up-to-date visibility of licence utilisation and deployment status. Policy Manifestation, Standards Alignment & Assurance Translate Group cyber technical standards and security policies into enforceable Microsoft platform configurations; maintain a clear, auditable mapping between each policy requirement and its implementation in Defender, Entra, Intune, or other Microsoft controls, and ensure divergence is identified and remediated promptly. Work closely with the Director of Cyber Assurance and Assurance leads to support controls assessment of the Microsoft estate; provide technical evidence of configuration compliance . click apply for full job details

Title: Cyber Architecture Manager Reference No: 2158 Company: FTSE 100 Reports to: Deputy Group CISO Location: London Working Pattern: 37.5 hours per week, Monday - Friday. Location: London/Peterborough, with potential travel to divisional sites as required by advisory engagements (hybrid working arrangements in place). Salary: £84,000 - £100,000 Benefits: Car allowance, Bupa, Matched pension contributions. The Role Group Cyber Security Overview The Group Cyber Security (GCS) team is responsible for managing cyber risk appropriately across the Group and has recently refreshed its cyber strategy, with a renewed focus on embedding cyber security as part of the culture and DNA. The Group operates a highly federated business model spanning 11 divisions and over 50 countries, and the cyber strategy has been designed to build materially improved security capabilities whilst working with a divisional focus. It is an exciting time to join GCS. We are in a period of significant investment, with a multi-year transformation programme under way to build new security capabilities at pace. GCS is responsible for setting the Group cyber standard, measuring compliance against it across all the businesses, and delivering a portfolio of centrally managed security services that divisions can rely on. A central challenge in a federated Group is translation: the work of turning Group-level standards, strategy, and expertise into something that actually lands and works inside each division's unique context. That is precisely the purpose of the Cyber Advisory Services function. It bridges Group Cyber Security and the divisions - providing the technical advice, subject-matter expertise, specialist project support, and flexible consulting resource that enables divisions to understand, adopt, implement, leverage and operationalise the Group cyber standard. Role Summary Reporting to the Deputy Group CISO, the Cyber Architecture Manager is the most senior cyber security architect and the authoritative voice on all matters of security architecture across the Group. The role owns the Group's cyber enterprise architecture, setting the standards, patterns, and principles that govern how security is designed, built, and integrated across all 11 divisions - whether through centrally delivered services, divisional programmes, or third-party technology. The role leads the Group cyber technical standards programme, defining the security technology baseline that all divisions are expected to achieve and maintain and is intrinsically aligned with the group technology office. It shapes the technology roadmap for the centrally delivered cyber services portfolio - encompassing the strategic platforms and capabilities that GCS operates on behalf of the Group - and ensures that investment decisions are grounded in sound architectural thinking and aligned to the long-term security strategy. Beyond Group-level ownership, the Cyber Architecture Manager provides architectural direction, advice, and technical guidance to divisional security and IT teams acting as a trusted adviser and challenge function to ensure that division-led initiatives are architecturally sound and consistent with Group standards. The role leads a blended team of permanent cyber architects and resources drawn from within Cyber Security and from the GCS flexible resourcing desk, deploying expertise where it is most needed across the transformation programme and business-as-usual demand. Role Responsibilities / Accountabilities Cyber Enterprise Architecture Own and maintain the Group cyber enterprise architecture, defining the security architecture principles, patterns, and reference models that provide the authoritative framework for how security is designed and implemented. Translate the Group cyber security strategy into a coherent, actionable architecture that spans all domains - network security, identity and access management, endpoint, cloud, OT, data protection, AI, and application security - ensuring consistency across a complex, federated estate. Act as the Group's senior design authority for cyber security, providing architectural oversight and sign-off on significant technology investments, transformations, and programmes that have material security implications. Group Cyber Technical Standards Lead the development, publication, and lifecycle management of the Group cyber technical standards library, covering all major security domains; ensure standards are technically rigorous, aligned to industry and regulatory best practise practically implementable, and kept current with the evolving threat and technology landscape. Work in close partnership with the Head of Cyber Assurance to ensure technical standards are enforceable, measurable, and directly underpinned by the policy framework; support their use as the basis for control assessment and compliance measurement. Define and maintain the technical baseline for the Group ISMS, ensuring security engineering requirements are fully integrated into the ISO/IEC 27001:2022 as well as compatible with other key frameworks such as NIS2, IEC6243, EU AI Act and NIST. Strategic Technology Roadmap for Centrally Delivered Cyber Services Own and maintain the technology roadmap for the centrally delivered cyber services portfolio - encompassing the strategic platforms and capabilities that GCS operates on behalf of the Group, including (but not limited to) identity and access management, SIEM/SOAR, endpoint protection, cloud security, network security, and OT security. Provide architectural input to the GCS investment planning cycle, ensuring technology decisions are grounded in sound architectural thinking, aligned to the long-term security strategy, and capable of delivering the required security outcomes at Group scale. Lead technology evaluation and selection for strategic cyber platforms, conducting market assessment, proof-of-concept oversight, and architectural due diligence to ensure the organisation selects the right tools for the right problems at the right time. Drive platform consolidation and rationalisation across the Group, reducing complexity and vendor sprawl while improving security capability maturity and value for money. Divisional Architectural Direction & Advisory Set the architectural direction for divisional cyber and IT security teams; provide a clear framework of Group-level patterns, approved reference architectures, and design principles that divisional teams are expected to adopt and adapt within. Act as the senior architectural resource and escalation point for divisional BISOs and IT security teams, providing expert guidance and challenge on division-led security technology initiatives, acquisitions, and significant infrastructure changes. Ensure that divisional security architectures are consistent with Group standards and enterprise architecture principles; identify and remediate architectural debt and divergence across the estate in a risk-proportionate and pragmatic manner. Provide architectural input to acquisition due diligence, integration planning, and divestiture activities, ensuring cyber security risks and architectural implications are identified and addressed at the earliest opportunity. Cyber Technology Advice, Guidance & Direction Ensure Full alignment with the Group Technology office (CTO); Wider technology frameworks and other architectural functions across the group. Serve as the foremost cyber technology authority, providing authoritative advice and direction to the Deputy CISO, Group CISO, senior business stakeholders, and divisional leadership on the security implications of technology choices, emerging threats, and market developments. Maintain awareness of the evolving cyber technology landscape - including developments in AI-driven security, zero trust, cloud-native security, OT/IT convergence, and identity-centric architectures - and translate that intelligence into timely, actionable recommendations. Manage relationships with strategic technology vendors and partners; provide architectural oversight of vendor engagements and ensure that commercial commitments are consistent with the Group's architectural direction and long-term interests. Team Leadership & Resourcing Lead, develop, and inspire a blended team of permanent cyber architects and resources drawn from the GCS flexible resourcing desk; foster a high-performance, collaborative culture with clear standards of delivery and professional development. Manage the deployment of architecture resource across the transformation programme and BAU demand pipeline, working with the Deputy CISO and programme leadership to prioritise activity, balance workload, and deploy expertise where it delivers most value. Manage the flexible resourcing desk relationship for the architecture function, including defining resource requirements, briefing and onboarding contractors and specialist resources, and maintaining quality and consistency of output across permanent and flexible team members. Build and maintain a strong architectural community of practice across GCS and divisional teams, promoting knowledge-sharing, peer review, and continuous improvement in the quality of security design. Transformation Programme & Strategic Projects Provide senior architectural leadership to the GCS transformation programme, ensuring that new capabilities are designed to a consistent high standard, integrated effectively into the existing estate . click apply for full job details

Information Security Solutions is seeking a Cyber Advisory Services Manager to lead consulting and advisory initiatives. This role requires a strong background in cyber security, with responsibilities including providing tailored support to divisions, managing policy assessments, and facilitating compliance with Group standards. The ideal candidate should possess at least 10 years of experience in cyber security, demonstrating expertise in advisory services and stakeholder engagement in complex environments. This position offers a hybrid work model and competitive salary ranging from £84,000 to £100,000, along with additional benefits.

Cyber Advisory Services Manager Location: London or Peterborough with potential travel to divisional sites as required by advisory engagements (hybrid working arrangements in place). Working Pattern: 37.5 hours per week, Monday - Friday. Salary: £84,000 - £100,000 Benefits: Car allowance, Bupa, Matched pension contributions. Group Cyber Security Overview The Group Cyber Security (GCS) team is responsible for managing cyber risk appropriately across the Group and has recently refreshed its cyber strategy, with a renewed focus on embedding cyber security as part of the culture and DNA. The Group operates a highly federated business model spanning 11 divisions and over 50 countries, and the cyber strategy has been designed to build materially improved security capabilities whilst working with a divisional focus. It is an exciting time to join GCS. We are in a period of significant investment, with a multi year transformation programme under way to build new security capabilities at pace. GCS is responsible for setting the Group cyber standard, measuring compliance against it across all the businesses, and delivering a portfolio of centrally managed security services that divisions can rely on. Role Summary Reporting to the Deputy Group CISO, the Cyber Advisory Services Manager leads the GCS consulting and advisory capability - the function that turns Group cyber standards and expertise into practical, tailored support for all the divisions. This is a role for a confident, credible cyber security generalist with strong consulting instincts: someone who is equally comfortable advising a divisional CIO on strategic security posture, reviewing a firewall ruleset for technical debt, or scoping the cyber workstream of a merger integration programme. The role provides a broad portfolio of advisory services to the Group and its divisions, including technical standards advice and interpretation; security configuration, rule base assessment and policy change support; input to non functional security requirements for Group and divisional programmes; cyber security input to mergers, acquisitions, and divestiture activity; and the deployment of specialist consulting resource into divisions that need temporary uplift in cyber capability. The Cyber Advisory Services Manager acts as an important feedback loop into GCS: gathering intelligence from divisional engagements that informs the evolution of Group standards, identifies emerging needs, and ensures that GCS remains relevant and responsive to the businesses it serves. The role works in close partnership with the Cyber Architecture Manager, the Head of Cyber Assurance, and the Security Platform Engineering Manager to ensure that advisory activity is consistent with and supportive of the broader GCS strategy. Technical Standards Advisory & Interpretation Provide authoritative advice to divisions, business units, and Group functions on the interpretation and practical application of the Group cyber technical standards and security policies; acting as the primary advisory interface between GCS and the divisions on matters of standards compliance, technology and implementation. Help divisions translate Group cyber standards into their specific operational context - providing pragmatic, risk proportionate guidance on what good looks like in their environment, and a credible path from current state to compliant state. Feed intelligence from divisional advisory engagements back into the standards development process; identify where standards are unclear, impractical, or creating unintended barriers, and work with the Cyber Architecture Manager and Head of Cyber Assurance to drive improvements. Rule Base Assessment & Security Policy Change Lead and deliver security configuration and rule base reviews and security policy assessments for Group and divisional environments; identify technical debt, overly permissive rules, obsolete entries, and configuration drift, and provide clear, prioritised remediation recommendations. Provide technical review and advisory support for security policy change requests from divisions, assessing proposed changes against Group standards and architectural principles, and providing a clear recommendation with appropriate justification. Develop and maintain a structured approach to rule base and policy review across the Group, including tooling, methodology, scheduling, and output standards, ensuring consistent and repeatable assessment quality across different divisional environments. Non Functional Security Requirements Provide security input to non functional requirements (NFRs) for Group and divisional programmes and projects; define the security properties that technology solutions must meet - covering areas such as authentication, authorisation, encryption, logging, resilience, and data classification - in a form that is actionable by project and engineering teams. Maintain and evolve a Group standard NFR library derived from the Group cyber technical standards, enabling consistent security requirements to be applied across the programme portfolio without reinventing them for each project; work with the Cyber Architecture Manager to ensure NFRs remain aligned to the enterprise architecture. Engage with divisional and Group programme teams at the point where security NFRs are being defined, ensuring security is embedded by design rather than added retrospectively; provide advisory support through the project lifecycle where security design decisions need to be revisited or refined. Mergers, Acquisitions & Strategic Project Support Lead the GCS advisory contribution to mergers, acquisitions, and divestiture activity; scope and deliver the cyber workstream in M&A programmes, covering pre deal due diligence support, integration planning, and the transition of acquired entities onto the Group cyber standard. Provide cyber advisory resource and expertise to other significant Group and divisional strategic programmes - including major technology transformations, ERP deployments, cloud migrations, and site openings or closures - ensuring security considerations are addressed at the right point in the programme lifecycle. Maintain a forward view of the M&A and strategic programme pipeline in collaboration with Group corporate development and divisional leadership, enabling advisory resource to be planned and mobilised proactively rather than reactively. Divisional Resource Augmentation & Flexible Resourcing Pool Manage the GCS flexible resourcing pool as an advisory and consulting resource, deploying cyber consultants and specialist advisors into divisions that require temporary uplift in security capability - whether to support a programme, fill a capability gap, or accelerate compliance with Group standards. Work with divisional BISOs, CIOs, and IT security leads to understand their advisory and resource needs; define the scope and objectives of each deployment clearly, brief and onboard resources appropriately, and ensure that the output of each engagement meets the division's needs and GCS quality standards. Manage the demand pipeline for advisory and flexible resource deployments; prioritise requests in line with Group risk priorities, balance supply against demand, and ensure that resourcing decisions are transparent and agreed with the Deputy CISO and relevant divisional stakeholders. Ensure that flexible resources deployed into divisions are competent, well briefed on standards and culture, and set up to add genuine value from day one; maintain quality standards across the pool and build a pipeline of trusted specialists who understand the environment. Divisional Engagement & GCS Intelligence Loop Build and sustain trusted relationships with divisional BISOs, security leads, CIOs, and IT directors across all 11 divisions; position the Cyber Advisory Services function as a valued, accessible, and practical source of cyber expertise - not a bureaucratic overhead. Use divisional advisory engagements as an active intelligence gathering mechanism; identify common themes, recurring challenges, emerging risks, and capability gaps across the estate, and bring these insights back to the GCS Leadership Team to inform strategy, standards development, and investment priorities. Champion the GCS advisory model as a two way relationship; ensure divisions feel heard and that their feedback genuinely influences how GCS operates, while maintaining the Group standards and non negotiables that the advisory function exists to support. Team Leadership, Quality & Continuous Improvement Lead and develop the permanent Cyber Advisory Services team; set clear standards of advisory quality, professional conduct, and output, and foster a culture where consultants take personal pride in the value they add to the divisions they support. Develop and maintain a service catalogue for the Cyber Advisory Services function that clearly articulates what the function offers, how to engage it, what divisions can expect, and how outcomes will be measured; make the function easy to access and straightforward to work with. Work in close partnership with the Cyber Architecture Manager, Head of Cyber Assurance, and Security Platform Engineering Manager to ensure advisory activity is consistent with the GCS strategy, avoids duplication of effort, and is integrated into the broader GCS operating model. Experience, Knowledge, Skills & Attributes - Essential Experience 10+ years in cyber security, with a significant portion in advisory, consulting, or technical leadership roles requiring breadth across multiple security domains click apply for full job details

Title: Head of Cyber Assurance Reference No: 2156 Company: FTSE100 Location: London - 3 days in the office (Tuesday - Thursday) plus if required for specific meetings on other 2 days Working pattern: This hybrid role is 37.5 hour week Monday - Friday Reports to: Group CISO Salary: £130,000 - £150,000 The Role Group Cyber Security Overview The Group Cyber Security (GCS) team is responsible for managing cyber risk appropriately across the Group. The cyber strategy has been refreshed, with a renewed focus on embedding cyber security as part of the culture and DNA. The Group is a highly federated business model spanning 10 divisions, 90+ businesses and over 50 countries, and the cyber strategy has been designed to build materially improved security capabilities while working with and through that model. It is an exciting time to join GCS - we are in a period of significant investment and transformation. GCS is establishing the Group cyber standard, measuring compliance against it across all the businesses, and standing up new capabilities at pace. This permanent role will play a pivotal part in shaping that programme and, as it maturing, in owning and continuously improving the assurance, risk, and governance functions at the heart of the Group's security posture. Role Summary Reporting to the Group CISO, the Head of Cyber Assurance leads the second line of defence for cyber security - providing independent, risk based oversight across governance, risk management, regulatory compliance, and assurance. The role is the functional owner of everything GRC touches: from information security policy and non technical standards, through enterprise cyber risk management and third party security, to continuous controls assessment, audit management, and regulatory reporting. This role oversees continuous controls monitoring, leveraging tooling, to provide real time visibility of control coverage and effectiveness, and translates that data into meaningful management information for informed governance decisions. They govern risk acceptance and exceptions, manage regulatory obligations under GDPR, NIS2, and DORA, and act as the primary liaison with legal teams and regulators. Beyond formal governance, this role drives cyber communications, culture, and awareness across the diverse workforce; leads the Group security hygiene and resilience programme; produces Board, ExCo, and Information Security Committee reporting packs; and coordinates crisis exercising and playbook execution to ensure the organisation is ready to respond to major cyber incidents. Strategic Leadership & Stakeholder Engagement Lead and develop the Group Cyber Assurance function, establishing a high performing second line of defence and embedding risk based decision making as a natural habit across the organisation. Act as a trusted adviser to the Group CISO and senior stakeholders on all GRC matters; work in partnership with the GCS Leadership Team across all verticals and represent the Group in external forums and regulatory engagements. Collaborate with divisional GRC functions, BISOs, legal, finance, and operational teams to ensure integrated and proportionate risk management; build and sustain trusted relationships with senior stakeholders across a large, federated Group. Information Security Policy, Standards & Governance Own and maintain the Group information security policy framework and all non technical standards; ensure they are current, enforceable, written in plain language, and visibly aligned to external regulation and the Group's risk appetite. Govern the risk acceptance and exception process end to end: ensure all policy deviations are formally assessed, justified, approved at the appropriate level, time bounded, and subject to periodic review. Plan, chair, and facilitate the Group Security Working Group (SWG) and wider governance forums; produce regular, concise reporting for senior leadership, the ISC, and audit committees. Cyber Risk Management & Risk Exceptions Governance Develop and operate enterprise wide cyber risk management processes; maintain the Group cyber risk register and ensure risks are accurately captured, assessed, owned, mitigated, and escalated appropriately across all 11 divisions. Lead risk quantification initiatives; implement methodologies and develop metrics that communicate risk reduction in business terms, enabling the CISO and ExCo to make well informed investment and prioritisation decisions. Conduct horizon scanning for emerging regulatory requirements and threat driven risk changes; ensure the Group risk posture is proactively managed rather than reactively patched. Third Party & Supply Chain Security Assessment & Management Define and deliver the Group third party cyber security strategy; drive a step change in third party risk capability through the Third Party Management workstream of the cyber transformation programme. Manage third party cyber risk at point of contract and through ongoing assurance; build a proportionate, risk tiered assessment framework and deliver a measurable reduction in supply chain cyber risk exposure across the Group. Continuous Controls Assessment & Control Effectiveness MI Lead the Group continuous controls monitoring programme, leveraging Axonius and complementary tooling to provide real time, evidence based visibility of control coverage, gaps, and drift across the estate. Design and produce control effectiveness MI that is meaningful to different audiences - from technical teams needing remediation data to ExCo and Board needing a clear view of overall security posture. Cyber Assurance Programme & Audit Finding Management Define and deliver the end to end Group cyber assurance programme, encompassing internal reviews, thematic assessments, divisional control testing, and first line challenge - providing the CISO with independent confidence in the state of security controls. Own the management of audit findings across internal audit, external audit, and regulatory reviews; drive timely remediation, track progress rigorously, and ensure sustainable rather than cosmetic closure of issues. Cyber Communications, Culture & Awareness Drive cyber awareness and behavioural change agenda; develop and deliver engaging, targeted programmes that embed a strong security culture across a diverse, geographically dispersed, and federated workforce. Lead Group cyber communications, ensuring messaging is clear, consistent, aligned to risk priorities, and pitched appropriately for each audience from shopfloor to Board; influence organisational culture to embed risk based thinking at every level. Regulatory Reporting (GDPR / NIS2 / DORA) & Legal Liaison Lead regulatory compliance reporting across applicable regimes, including GDPR, NIS2, and DORA; act as the primary cyber security liaison to legal teams and regulators, ensuring responses are consistent, accurate, defensible, and filed within required timeframes. Monitor the evolving regulatory landscape across the global operating jurisdictions; proactively advise the CISO and business on incoming obligations and ensure compliance posture is maintained ahead of regulatory change. Security Hygiene & Resilience Programme Lead the Group security hygiene and operational resilience programme, strengthening the ability to prevent cyber incidents, detect threats early, and recover effectively - with clear metrics, targets, and accountability for improvement. Define and track hygiene KPIs - including patching currency, MFA adoption rates, vulnerability remediation SLAs, and phishing resilience scores - and report progress against targets to senior leadership and divisional stakeholders. Board / ExCo / ISC Reporting Pack Production Produce clear, authoritative, and insightful reporting packs for the Board, Executive Committee, and Information Security Committee; deliver a joined up view of cyber risk, control effectiveness, assurance outcomes, and regulatory standing that enables confident governance decisions. Respond to ad hoc reporting requests from divisions, business units, and senior management; translate complex technical risk and assurance matters into accessible, decision ready business language. Crisis Exercising & Playbook Execution Coordinate Group cyber crisis exercising, including tabletop scenarios, cross divisional simulations, and Executive level war gaming; ensure the Group is genuinely prepared - not just theoretically compliant - to respond to major cyber incidents. Own the cyber incident response playbook framework; ensure playbooks are maintained, tested, regularly updated to reflect the threat landscape, and actionable by the right people at pace when an incident occurs. Experience, Knowledge, Skills & Attributes Essential Experience 10+ years in cyber security, information security, or technology risk, with demonstrable progression into senior leadership roles. Proven track record designing and operating a cyber GRC / second line of defence function within a large, complex, or highly regulated organisation. Demonstrable experience of enterprise cyber risk management, including quantification methodologies, risk register ownership, and reporting to Board and ExCo. Experience managing regulatory compliance obligations including GDPR and NIS2; working familiarity with DORA or equivalent financial or operational resilience frameworks. . click apply for full job details

Information Security Solutions is seeking a Head of Cyber Assurance to lead the Group Cyber Assurance function and ensure independent oversight of governance, risk management, and regulatory compliance. This hybrid role requires over 10 years in cyber security and involves producing reporting packs for senior leadership. The ideal candidate will possess a strong background in managing third-party security programmes and cyber risk management within a large organization. The position is based in London with a salary range of £130,000 - £150,000.