Lead Information Security Officer

The Lead Information Security Officer is a senior Information Security practitioner and people leader responsible for directing the day-to-day work and development of the global Information Security team.

Based in the Pune GCC centre and reporting to the Group Head of Cyber, the role will retain the core governance, risk, compliance, awareness and advisory responsibilities of the Group Information Security Officer while providing clear leadership, prioritisation, quality oversight and escalation support for the wider team. The role will help the business achieve its objectives safely through appropriate and proportionate controls, policies, standards and risk management practices, supported by clear executive and Board-level reporting.

Key Responsibilities

• Provide line management, coaching, objective setting, performance support and professional development for the whole Information Security team, including colleagues working across locations and time zones.
• Plan, prioritise and allocate team activity, monitor delivery against agreed objectives and ensure consistent quality, service and governance standards.
• Act as the primary escalation point for Information Security risks, issues and incidents, escalating material matters to the Group Head of Cyber and supporting out-of-hours response where required.
• Lead the development, review and implementation of Information Security governance processes, policies, standards and control requirements in response to business change, emerging threats, legislation and regulation.
• Lead the Information Security risk management approach, ensuring risks are identified, assessed, recorded, treated, monitored and reported across the Group.
• Lead complex information security and third-party risk assessments, balancing technical, physical, procedural and people controls with business needs and risk appetite
• Lead the production of Information Security requirements for suppliers, business initiatives and compliance activities, working with the wider Governance, Risk and Compliance function to ensure risks are appropriately managed.
• Lead the Information Security training and awareness programme, ensuring colleagues understand their security responsibilities and how their work supports organisational objectives.
• Provide pragmatic Information Security advice and challenge to senior stakeholders, programmes, projects and operational teams, enabling secure business decisions.
• Own the production and quality assurance of monthly Information Security risk dashboards, KPI and KRI reporting, and executive and Board-level updates.
• Support internal and external audits, regulatory reviews and customer assurance activities, ensuring evidence, remediation actions and responses are complete, accurate and timely.
• Support security incident response, lessons learned and control improvement activities, coordinating Information Security input with Cyber Security, Privacy, Data Governance, Technology and business teams.
• Promote effective collaboration across Cyber Security, Information Assurance, Privacy, Data Governance and the wider GRC function to maintain a cohesive approach to security risk management.
• Deputise for the Group Head of Cyber on Information Security matters where required.

Skills, Knowledge and Expertise

• Minimum 10 years’ experience across Information Security, cyber security, governance, risk or compliance roles within large or complex organisations.
• Demonstrable experience leading and developing geographically distributed teams, including effective remote line management.
• Significant experience implementing and maintaining global Information Security and cyber risk frameworks, including ISO/IEC 27001, NIST Cybersecurity Framework and CIS Controls.
• Bachelor’s degree in Information Security, Cyber Security, Information Technology, Risk Management or a related discipline, or equivalent relevant professional experience.
• Experience working in regulated sectors and engaging with senior management, auditors, regulators, customers and third parties.
• Strong working knowledge of Information Security governance, risk management, control design, policy management, security awareness and third-party assurance.
• Ability to translate complex security, regulatory and risk matters into clear, proportionate and actionable business advice.
• Excellent leadership, coaching, delegation, workload planning and team development capability.
• Ability to lead complex risk assessments and provide credible challenge to senior stakeholders.
• Strong knowledge of global security regulations, recognised security frameworks and industry good practice.
• Experience producing meaningful executive and Board-level dashboards, metrics and risk reporting.
• Security incident response experience and an understanding of the interaction between governance, operational security and technology controls.
• Strong stakeholder and supplier relationship management skills across global and multicultural environments.
• Commercial awareness and the judgement to balance business enablement with appropriate protection of information and services.
• Excellent written and verbal communicator, able to adapt style for technical, non-technical and executive audiences.
• Proven people leader with a collaborative, service-led and accountable approach.
• Confident decision-maker who can prioritise competing demands and operate effectively under pressure.
• Strong documentation, analytical and problem-solving skills.
• Pragmatic and proportionate risk mindset, with the confidence to challenge constructively.
• Experience working within highly regulated businesses.
• Flexible approach to working hours to support a global team and material security incidents when required.
• Commitment to continuous professional development and sharing good practice across the team.
• One or more relevant professional certifications, such as CISM, CISSP, CRISC or ISO/IEC 27001 Lead Implementer or Lead Auditor, is highly desirable.
• Active membership of a recognised professional body, or equivalent evidence of continuing professional development, is desirable.