About the role
- ISMS & Certification Management: Maintain and continuously improve the ISO 27001:2022 ISMS; coordinate Wallbrook, Digital, and MERO certification scopes; manage surveillance and recertification audits; maintain the Statement of Applicability, policies, standards, procedures, and evidence; track findings, corrective actions, observations, and non-conformities; and ensure ongoing audit readiness.
- Governance, Risk & Compliance: Facilitate information security risk assessments and treatment activities; monitor control effectiveness and compliance obligations; support internal control reviews and assurance activities; maintain metrics, dashboards, and reports; and improve security policies and standards.
- Client Assurance & Compliance Support: Support customer reviews, due diligence, vendor assurance, security assessments, and questionnaires; maintain evidence repositories and certification documentation; assist contract compliance reviews; and support customer and procurement requirements.
- Audit & Stakeholder Management: Coordinate internal and external auditors; work with control owners to obtain evidence and implement corrective actions; guide business and technology stakeholders; support management reviews and executive reporting; and promote security awareness and governance maturity.
- AI Governance Readiness: Support governance frameworks aligned with ISO/IEC 42001, including AI risk management, policy development, compliance activities, governance initiatives, and future certification readiness.
- Other duties as assigned by the manager.
Skills, Knowledge & ExpertiseCompetences and Skills
- Strong understanding of ISO 27001:2022 requirements and certification processes.
- Working knowledge of ISO/IEC 42001, NIST CSF, SOC 2, GDPR, and related frameworks.
- Experience managing audits, evidence collection, and corrective action programmes.
- Strong stakeholder management and communication skills.
- Ability to coordinate across Security, Legal, IT, Sales, and business functions.
- Excellent documentation, organisation, and reporting capabilities.
- Strong analytical and risk-based decision-making skills.
- Ability to work independently across multiple priorities and time zones.
- Bachelor’s degree in Information Security, Computer Science, Information Technology, Risk Management, Audit, or a related discipline.
- 8-10 years of experience in information security governance, compliance, ISMS management, audit, or risk management.
- Demonstrable experience supporting or maintaining ISO 27001 certification programmes, audits, compliance assessments, evidence management, and regulatory requirements.
- Professional proficiency in English.
- ISO 27001 Lead Implementer or Lead Auditor certification; ISO/IEC 42001 or AI governance experience; customer, vendor, or third-party assurance experience; and certifications such as CISA, Security+, CRISC, or CISSP.