InfoSec Manager

Key Responsibilities

• Own the full client-facing InfoSec process from initial security request through completion and approval.
• Manage enterprise security questionnaires, vendor assessments, compliance forms, procurement security documents, evidence collection, and follow-up actions.
• Drive new ISO readiness , including coordinating evidence, controls, audit preparation, remediation activities, and maintaining the ISMS on a day-to-day basis.
• Own operational GDPR and data protection activities , including DPAs, DPIAs, privacy/security assessments, and reviewing security and privacy clauses within client and vendor contracts.
• Maintain all company security materials, including trust page content, data-room documents, policies, procedures, certifications, architecture diagrams, compliance evidence, and supporting security documentation.
• Build and maintain a central InfoSec knowledge base containing approved standard responses, reusable evidence, and guidance for common enterprise security and privacy questions.
• Join client security calls when required and work with technical/data infrastructure owners to accurately explain architecture, hosting, data flows, access control, encryption, backup, logging, monitoring, incident response, and secure development practices.
• Work with leadership, engineering, infrastructure, QA, legal/privacy stakeholders, and client-facing teams to ensure security and compliance responses are accurate, consistent, proportionate, and professionally managed.
• Support new certifications, renewals, audits, assessments, recurring compliance reviews, and ongoing security evidence requests.
• Propose practical and proportionate security and compliance improvements across software development, deployment, cloud infrastructure, access management, incident response, vendor management, and client onboarding.
• Apply security and compliance controls pragmatically so that risk is appropriately managed without creating unnecessary process, slowing procurement, or introducing avoidable blockers for clients, vendors, or internal teams.
• Coordinate with team to ensure deployment environments follow approved security and compliance standards.
• Coordinate with QA and engineering for security testing, access testing, permission validation, secure SDLC evidence, and other required assurance activities.