Information Security Director - UK

The Information Security Director develops, shapes and maintains Sycurio’s information security capability, driving the attainment and maintenance of the ISO27001, PCI-DSS and SOC2 compliance. They are the subject matter expert on all things regarding security and compliance, owning the information risk management processes. They are the thought leader on all matters within the security and compliance domain such that the company remains secure against the ever-changing security threat and compliance landscape.

Information security strategy

• Create and maintain the Company’s strategy, ensuring alignment to the Company’s strategy and business goals.
• Work across internal and external stakeholders, communicating the information security strategy to relevant parties, providing assurance of policies, procedures, and systems.
• Develop, maintain, and expand the information security management system (‘ISMS’) in line with optimised compliance for ISO27001, PCI-DSS and SOC2 compliance.
• Identify gaps in the information security capability, both technical and operational, and propose remediation and mitigation plans and solutions.
• Responsible for the Company’s information security capability, ensuring it remains secure against an ever-changing threat landscape.

Operational input

• Contribute to design and architectural decisions and improve approach to the Company’s threat modelling.
• Lead on information security incidents and work directly with internal teams and external parties on containment and mitigation activities.
• Execute threat simulations.
• Assess emerging and potential security threats and act proactively to mitigate relevant threats.
• End-to-end vulnerability management.
• Manage security toolset.
• Act as the security “face” of Sycurio to its customers, suppliers and auditors, supporting both in-life and sales engagements.
• Manage and participate in the response to security questionnaires from customers and prospects.

Key qualifications, skills, experience:

• Qualifications: Bachelor's degree in Computer Science, Cybersecurity, or related field (Master's preferred). Industry certifications such as CISSP, CISM, CISA, or equivalent.
• Experience: 10+ years of information security experience. Financial/Fintech services/payments desirable. Deep knowledge of security frameworks (PCI, ISO 27001, NIST) and regulations (GDPR, CCPA). Experience with PCI DSS compliance and implementation. Proven success in managing external auditors to achieve positive outcomes. Expert in information security with strong communication and stakeholder management skills. Experience in managing security incidents and leading incident response. Experience with security assessment tools and vulnerability management. Strong vendor management and third-party risk assessment experience.
• Skills: Strong understanding of cloud security principles and best practices, particularly in AWS. Solid understanding of payment processing systems and associated security controls. Good communication and interpersonal skills, with the ability to effectively communicate security-related questions to technical and non-technical stakeholders (employees, customers, or partners). Project management skills, with the ability to manage projects such as processes implementation and improvement, security systems implementation. Ability to collaborate cross-functionally and influence stakeholders at all levels of the organisation. Good knowledge of Dev(Sec)Ops and how to implement secure software development practices.