Manager – Information Security (ISO 27001)

About the role

The Manager – Information Security will lead the organisation’s information security framework, overseeing ISO 27001 certification, security operations, risk management and audit activities. This senior position requires hands‑on expertise in security governance and the ability to work closely with technical teams and senior leadership.

Key responsibilities

• Own the end‑to‑end ISO 27001 ISMS implementation, certification lifecycle and continuous audit readiness.
• Manage day‑to‑day security operations, including threat monitoring, incident response, vulnerability management and administration of SIEM, endpoint protection, WAF, IAM and DLP solutions.
• Define and enforce security baselines for cloud infrastructure (AWS, GCP, Azure) and API environments, integrating security into DevSecOps processes.
• Conduct periodic risk assessments, maintain a risk register, develop policies, standards and procedures, and report security metrics to senior leadership.
• Plan and execute internal security audits, liaise with external auditors and regulatory bodies, and maintain comprehensive audit evidence.

Required profile

• 10–15 years of experience in information security, with proven ownership of ISO 27001 implementation and audit cycles.
• Strong background in security operations, SOC management, incident response and vulnerability management.
• Deep understanding of cloud security (AWS, GCP, Azure) and API security principles.
• Experience in governance, risk management, compliance and audit management.
• Relevant certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISSP or CISM.
• Excellent communication and stakeholder‑management skills.

Required skills

• ISO 27001 implementation and audit
• SIEM platforms
• Endpoint protection solutions
• Web Application Firewall (WAF)
• Identity and Access Management (IAM)
• Data Loss Prevention (DLP)
• Cloud platforms: AWS, GCP, Azure
• API security
• Vulnerability management
• Incident response
• Risk assessment and mitigation
• Audit planning and execution