We are looking for an InfoSec Manager who will run the company's day-to-day Governance, Risk, and Compliance (GRC) activities under GDS, including security documentation, client security reviews, enterprise InfoSec processes, certifications, privacy requirements, and security readiness. Strategic security direction and oversight will sit with the Fractional CISO, while the InfoSec Manager will be responsible for ensuring that agreed security and compliance processes are executed effectively across the business.

This person will become the primary operational owner for InfoSec and GRC when enterprise clients request security reviews, questionnaires, vendor assessments, certifications, contractual security information, or compliance evidence.

This role is important because the company needs a strong but practical InfoSec foundation to build client trust, demonstrate reliability, and ensure security, compliance, documentation, certifications, and data protection requirements are professionally managed. The focus is on applying security and compliance intelligently and proportionately, avoiding unnecessary process overhead or procurement blockers while maintaining appropriate risk controls.

Key Responsibilities

Own the full client-facing InfoSec process from initial security request through completion and approval
Manage enterprise security questionnaires, vendor assessments, compliance forms, procurement security documents, evidence collection, and follow-up actions
Drive new ISO readiness, including coordinating evidence, controls, audit preparation, remediation activities, and maintaining the ISMS on a day-to-day basis
Own operational GDPR and data protection activities, including DPAs, DPIAs, privacy/security assessments, and reviewing security and privacy clauses within client and vendor contracts
Maintain all company security materials, including trust page content, data-room documents, policies, procedures, certifications, architecture diagrams, compliance evidence, and supporting security documentation
Build and maintain a central InfoSec knowledge base containing approved standard responses, reusable evidence, and guidance for common enterprise security and privacy questions
Join client security calls when required and work with technical/data infrastructure owners to accurately explain architecture, hosting, data flows, access control, encryption, backup, logging, monitoring, incident response, and secure development practices
Work with leadership, engineering, infrastructure, QA, legal/privacy stakeholders, and client-facing teams to ensure security and compliance responses are accurate, consistent, proportionate, and professionally managed
Support new certifications, renewals, audits, assessments, recurring compliance reviews, and ongoing security evidence requests
Propose practical and proportionate security and compliance improvements across software development, deployment, cloud infrastructure, access management, incident response, vendor management, and client onboarding
Apply security and compliance controls pragmatically so that risk is appropriately managed without creating unnecessary process, slowing procurement, or introducing avoidable blockers for clients, vendors, or internal teams
Coordinate with team to ensure deployment environments follow approved security and compliance standards
Coordinate with QA and engineering for security testing, access testing, permission validation, secure SDLC evidence, and other required assurance activities
Maintain an InfoSec action tracker covering client requests, risks, missing evidence, audit findings, certification tasks, remediation items, owners, and completion status
Escalate material or high-risk security and compliance findings to the Head of GDS, or senior leadership, providing clear context, risk assessment, and recommended actions
Work within the strategic security direction established by the Fractional CISO while owning the day-to-day execution and continuous improvement of GRC activities under GDS

Requirements

Strong hands-on experience with ISO 27001 and SOC 2, including implementation, control operation, audit preparation, evidence collection, remediation, or certification readiness
Practical experience with GDPR, DPAs, DPIAs, data protection requirements, privacy/security contractual clauses, and associated compliance evidence
Strong experience completing enterprise security questionnaires, client security assessments, vendor-risk reviews, procurement security requirements, and related evidence requests
Strong understanding of GRC, application security, cloud security, data protection, enterprise security reviews, and risk management
Working knowledge of cloud platforms such as GCP, sufficient to confidently support enterprise security assessments and client security discussions
Knowledge of access control, SSO, encryption, key management, logging, monitoring, backup and recovery, incident response, vulnerability management, and secure SDLC practices
Ability to read and understand architecture diagrams, API flows, data-flow diagrams, infrastructure documentation, and technical security evidence
Experience preparing, organizing, and presenting security and compliance evidence for enterprise clients, auditors, and assessors
Strong documentation, stakeholder management, and communication skills, with the ability to translate technical and compliance topics into clear business responses
Ability to apply security and compliance requirements pragmatically, balancing risk reduction with commercial and operational needs
Relevant professional certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISM, or equivalent security/GRC certifications are highly valued

Benefits

Private Health Insurance
Paid Time Off
Work From Home
Training & Development