Cyber Security Manager

The Cyber Security Manager is CAUK's hands-on lead of day-to-day cyber security. The role works directly in our security tools, such as Microsoft Defender, to find and investigate issues rather than waiting for our managed service provider (MSP) to raise them. It holds the MSP and suppliers to account, and helps colleagues across the organisation stay safe online. It works closely with the Head of Data and Technology, the Technology Operations Manager, Risk, Compliance and Data to find control gaps, review evidence, track fixes and turn cyber risks into practical actions.
Privileged administration and technical execution sit with the MSP and relevant suppliers. The role has full read access to the technology environment and may be given elevated access in specific areas where agreed, but does not hold global administrator rights. The Cyber Security Manager is accountable for internal ownership, challenge, follow-up and evidence of control effectiveness, using reporting, assurance evidence, risk assessment, supplier engagement and remediation tracking to validate that cyber risks are understood and addressed. The Technology Operations Manager owns the MSP relationship and day-to-day technology operations; this role feeds security challenge and requirements into those service reviews.
The role supports cyber resilience across the organisation by overseeing areas such as the annual Cyber Essentials Plus renewal, vulnerability management, penetration testing follow-up, cyber insurance evidence, email security, phishing awareness, incident response planning, identity and endpoint security assurance, and cyber-related supplier actions.
The role will also support the Head of Data and Technology in moving CAUK towards stronger formal security assurance, such as ISO 27001 and SOC 2 Type 2, and in improving our NIST maturity score. The role is designed to grow with CAUK: as our cyber maturity increases, so will its scope and responsibility.

The role also acts as a business partner within the IT function, working with Risk, Compliance, Projects, Change, Data and wider business teams to make cyber security practical, proportionate and enabling. It helps unblock cyber-related delivery issues, clarify control requirements, coordinate MSP and supplier action, and ensure cyber security is embedded into operational technology activity without becoming a blocker to business outcomes.

We are looking for a self-starter who lives and breathes cyber security and knows what good looks like from hands-on experience. They will spot problems for themselves, keep up to date with current threats and be confident challenging the MSP and suppliers. They will also be articulate and engaging enough to help colleagues at all levels understand cyber risks and change their behaviour.

Role specific skills

• Hands-on security experience: Practical experience securing Microsoft 365 and Azure environments, including Entra ID, Intune, Conditional Access and Defender, so they know what good looks like and can tell when it is not being done.
• MSP and supplier challenge: Confidence to challenge MSPs and suppliers firmly and constructively, and to keep pushing until actions are complete. Experience of working with an MSP is desirable.
• Security awareness and training: Experience of, or a strong interest in, running phishing simulations and awareness training, ideally using KnowBe4. Articulate and engaging, able to explain cyber risks in plain language and run sessions that change behaviour.
• Passion for cyber security: A self-starter who keeps up to date with current threats and attack techniques, acts without waiting to be asked, and is keen to keep learning and grow with CAUK.
• Vulnerability and remediation management: Ability to coordinate vulnerability findings, penetration test actions, insurer findings, audit issues and cyber control gaps through to resolution.
• Cyber Essentials Plus and assurance readiness: Practical understanding of Cyber Essentials Plus renewal, evidence gathering, technical verification, remediation tracking and supplier coordination.
• Email and identity security: Understanding of email security, phishing risk, DMARC, SPF, DKIM, MFA, identity lifecycle controls, privileged access risks and supplier-led remediation.
• Endpoint and cloud security: Practical understanding of endpoint compliance, patching, Defender or equivalent tooling, Microsoft 365, Azure and cloud security controls.
• Incident response and cyber resilience: Ability to support incident response planning, escalation routes, lessons learned, cyber recovery actions and coordination with MSPs and internal stakeholders.
• Cyber insurance and external assurance: Experience supporting cyber insurance requirements, security questionnaires, DDQs, insurer portals, rescans, evidence packs and remediation updates.
• Data governance and privacy awareness: Ability to work with Risk, Compliance and Data teams on privacy-related cyber findings, access controls, data protection risks and supplier-supported remediation.
• Qualifications: A relevant certification such as Microsoft SC-200, SC-300 or AZ-500, CompTIA Security+ or equivalent is desirable.
• Business partnering: Ability to work with Risk, Compliance, Projects, Change, Data and business teams to make cyber security practical, proportionate and outcome-focused.
• Evidence and reporting: Ability to maintain clear cyber risk reporting, remediation trackers, control evidence, supplier actions, awareness metrics and management information.
• Continuous improvement: Ability to identify recurring cyber control weaknesses, improve processes and support a more resilient and well-controlled technology environment.

Leadership at Cash Access UK

• Build effective relationships across technology, Risk, Compliance, Data, business teams and suppliers, creating a constructive environment where cyber risks are raised and resolved early.
• Lead by influence, bringing clarity, pace and practical problem-solving to cyber-related activity across the organisation.
• Champion cyber security as an enabler of safe delivery, helping teams understand and manage risk without creating unnecessary blockers.
• Support colleagues with clear communication, pragmatic guidance and proportionate advice on cyber security requirements.
• Create confidence by following through on cyber actions, escalating when needed and maintaining transparent evidence of progress.

Establish psychological safety so colleagues feel confident to raise risks, near misses, control gaps and security concerns early.