Senior Information Security Officer

The role 

You will report to and work closely with the Director for Global IT Services & Cybersecurity (CISO) as part of the Information Security team, while engaging with senior leaders, technology teams and business functions across Europe. 

This is a senior, hands-on role in a function that is still being established. You will improve its structure and ways of working while delivering and coordinating governance, risk and assurance activities. You will influence how information security is embedded into business processes, technology decisions and supplier relationships. 

Your responsibilities 

Working closely with the CISO, you will: 

• Develop and maintain our information security governance model, control framework, policies, standards and practical guidance. 
• Coordinate the information security risk lifecycle, including assessments, treatment plans, risk acceptance, exceptions, follow-up and reporting. 
• Lead security assessments of suppliers and services by reviewing evidence, identifying material risks, documenting security decisions and tracking remediation. 
• Plan and perform security assurance reviews to evaluate whether controls are appropriately designed, implemented and operating effectively. 
• Advise management and employees on information security risks, requirements and proportionate safeguards. 
• Define and follow up security requirements in areas such as identity and privileged access, cloud and SaaS services, sensitive information and critical suppliers. 
• Develop security awareness activities and practical guidance, and measure whether they produce the intended results. 
• Establish meaningful security metrics and prepare clear reporting and decision support for the CISO and senior management. 
• Work with IT, Compliance & Legal, Procurement and business owners to ensure that security requirements and decisions are understood, and that agreed actions have clear owners and are followed through. 
• Ensure that security plans, decisions and supporting evidence are clearly documented, and that agreed actions are tracked to completion. 

Technical teams and business owners remain responsible for implementing and operating their controls. Your role is to define security requirements, provide informed professional challenge and assurance, and ensure that risks and actions are brought to the appropriate accountable owner for decision.