Information Security Manager

About Us: Neueda is a leading provider of technical and professional learning solutions for market leading finance, insurance, and technology organisations. We have an ambitious vision for growth, supporting organisations on the journey to equipping their people with the skills to achieve and sustain transformation. From onboarding new hires to nurturing senior leaders, we’re with you throughout your technology talent pipeline. We help some of the world’s largest companies empower their people with critical work place skills including AI, data science, and change management. Our flexible learning solutions incorporate impactful virtual, in-classroom and blended learning, led by our experienced, hands-on instructors. The result is tailored, outcome-driven learning solutions built by people who know technology, your sector, and your organisation’s needs. As a growing organisation, every person on our team plays a key role. This is more than just a job, it’s an opportunity to make a real impact, take ownership of your work, and grow alongside passionate, driven colleagues. If you’re excited to be part of something purposeful, collaborative, and fast-moving, we’d love to hear from you. Role Overview:As Information Security Manager you will protect Neueda’s information and our customers' trust. Your first priority is to achieve and maintain ISO 27001 certification, which our customers in regulated sectors increasingly expect, while enabling the business to deliver and grow at an acceptable level of risk. Reporting to the Chief Technology Officer (CTO), who is the accountable director for information security, you will set security policy, assess and score risk, check that controls work in practice and give clear, decision-ready recommendations.You will work in partnership with the Director of Engineering, whose IT and Engineering teams implement and operate the technical controls, and with risk owners across the business. You advise and recommend; risk owners decide on the risks in their areas within an agreed risk acceptance matrix, and the CTO decides High and Critical risks. You will have a direct route to the CTO (or their nominated deputy) for any critical risk or incident.You will act as Neueda's data protection lead, supporting our data protection programme and working with our external data protection advisor to ensure personal data is protected and requests from individuals are handled correctly.This is a full-time security role until we achieve ISO 27001 certification. You will be supported by an experienced virtual CISO (vCISO), who will provide guidance and direction through certification, and you will be mentored through your first six months. Once certification is achieved, there may be an opportunity to add learning consultancy work with our consulting and learning teams, giving you first-hand insight into how some of the world's largest organisations approach security.

Key Responsibilities

Achieve and maintain ISO 27001 certification by running the information security management system (ISMS), keeping the Statement of Applicability, internal audits and management reviews up to date.Identify, analyse and score security risks in our risk register, and present each High or Critical risk to the CTO as a one-page decision request with a clear recommendation.Support risk owners across the business to understand and decide on the risks in their areas, making sure every risk acceptance is recorded with an owner, a rationale and an expiry date.Report to the CTO in a concise monthly one-page report, and run the Quarterly Security Forum and the annual ISO 27001 management review with the risk owners.Write, maintain and review security policies and standards that reflect what is actually implemented.Lead the response to security incidents, including those involving personal data, engaging external experts where required and briefing the CTO promptly.Assure vulnerability and patch management and user access reviews: IT and Engineering do the work; you set targets, check they are met and report exceptions.Review the security of new tools (including AI tools), vendors and contractors before they are adopted, including privileged access held by third parties, and approve routine software requests from the pre-approved list.Make sure answers to customer security questionnaires are accurate and backed by controls that are in place, and help our customer-facing teams meet customer security requirements.Support compliance with UK GDPR and our contractual requirements, including correct handling of subject access requests.Run security awareness training, phishing simulations and incident response exercises across the business.Use automation, including compliance automation tooling, to reduce manual effort in evidence collection, questionnaires and reporting.Take an active part in the wider security community, for example ISC2 or ISACA chapters and industry events, to keep your knowledge current and bring good practice back to Neueda.

Qualifications

Essential:Typically 5+ years' experience in information security, including at least 2–3 years' hands-on experience running or supporting an ISO 27001 information security management system through audit.Practical experience of information security risk management and policy writing.Working knowledge of securing cloud-based productivity and collaboration platforms, endpoints and identity, and cloud-hosted environments.Knowledge of UK GDPR and data protection fundamentals.Able to explain risk in plain business terms, through concise written reports and clear recommendations for non-technical leaders.Able to influence and gain agreement without line authority.Experience balancing strategic thinking with hands-on delivery in a scaling business environment.ISO 27001 Lead Implementer or Lead Auditor certification, or working towards it.Desirable:Experience of leading an organisation through first-time ISO 27001 certification.Experience in financial services or another regulated sector, or in a learning, consultancy or professional services environment, including delivering training or creating learning content.Familiarity with compliance automation, application security tooling, AI governance and frameworks such as Cyber Essentials or NIST CSF.Experience of supplier due diligence and customer security questionnaires, and of working with managed security or SOC providers and external auditors.CISSP, CISM, CISA or CRISC, and relevant cloud security certifications.Education: a degree in computer science, information security or a related subject is desirable, but equivalent professional experience and certifications are equally valued.