Information Security & Data Protection Manager

Based: Remote (UK)/High Wycombe/London (N7)/Hybrid

Term: Permanent, Full time

Reporting to: Chief Information Officer (CIO)

Salary: £60000 - £85000 pa + excellent benefits

Overview

We’re looking for an Information Security Compliance Specialist to take ownership of our Information Security, Data Protection, and AI Governance programmes across the Focusrite Group. You will be the operational owner of our Information Security and Data Protection (ISDP) framework informed by ISO 27001 (ISMS), ISO 27701 (PIMS), Cyber Essentials and NIST CSF keeping us aligned to those standards and ready for certification and audit.

Working alongside development, IT and business teams, you will advise on security and privacy requirements for new and changing systems, ensuring appropriate controls are designed in, evidenced, and verified after implementation. You will also own the Group’s response to emerging risks in AI, translating evolving regulation (EU AI Act, UK AI principles, ICO guidance) into practical governance.

Responsibilities

• Information Security Systems:
• Framework & advisory: Own the Information Security and Data Protection Framework and its documentation, and advise IT, development, and business teams on security requirements.
• Tools & supplier assurance: Run the Business Approved Tools process (including assessment of AI tools, vendors, and use cases), own designated Information Security tools, and conduct supplier audit assessments.
• Certification & standards: Own certification readiness for Cyber Essentials and lead new certification efforts as the business requires.
• Threats, incidents & testing: Monitor cyber threats and translate them for the business, own the incident management process (including phishing response and simulation exercises), and manage vulnerability scans and penetration testing (including external Red/Purple/Blue Team engagements).
• Risk & resilience: Conduct risk assessments across products, systems, and processes; own the Information Security and Data Protection risk register, contributing to the Group Risk Management process; and maintain and test the Business Continuity Plan (BCP).
• AI Governance: Own the AI Governance framework, AI system inventory, and alignment with ISO 42001, NIST AI RMF, and the EU AI Act where appropriate.

• Data Protection compliance (UK GDPR, EU GDPR, US state privacy laws including CCPA/CPRA):
• Data subject rights & assessments: Handle Data Subject Rights requests and run Data Protection Impact Assessments (DPIAs).
• Records & registers: Maintain Records of Processing Activities, lawful basis register, consent records, and Legitimate Interest Assessments.
• Notices, cookies & marketing: Operate Privacy Notices and Cookie Tools, and advise on PECR and e‑privacy compliance including direct marketing and electronic communications.
• Privacy by Design & training: Help product managers and developers embed Privacy by Design, design and deliver Data Protection training and awareness across the Group.
• Retention & breach management: Own retention schedule, deletion/anonymisation processes, and personal data breach handling including detection triage, 72‑hour ICO/EU supervisory authority notification, data subject notification where required, and the breach register.
• Third parties & international transfers: Manage processor and sub‑processor governance, data transfer mechanisms, and transfer risk assessments.

• Change Management:
• Review and provide security and data protection sign‑off on changes to systems, products, and processes.
• Participate in the Change Advisory Board (CAB) and ensure security and privacy risks are assessed before changes are approved.
• Own change management procedures relating to Information Security and Data Protection, ensuring evidence is captured for audit.
• Ensure security and privacy requirements are embedded in the SDLC and release processes, working with development and operational teams.
• Track and report on the security impact of significant business, technology, and organisational change initiatives.

• Compliance & Audits:
• Generate monthly compliance and activity reports and other reports as required by senior management.
• Internal Audit: Reviewing Financial System compliance activities. Performing Internal Information Security Audits. Performing Internal Data Protection Audits.
• External audit: Be the key contact for any IT/Data Protection related audits by external bodies, ensuring requested data is supplied, complete, and accurate. Take ownership of any related audit issues. Generate audit support documents.

Keep up to date with developments in the security, privacy, and AI regulatory landscape, translating these into practical actions for the Group.

Qualifications

Several years’ experience in Information Security and Data Protection, with a good understanding of IT systems, web operations, cloud platforms, and secure coding practices (including OWASP). Comfortable engaging at all levels of the organisation and externally, with the gravitas to influence security and privacy outcomes and reduce the impact of change. The position requires providing support and advice to all parts of the Group on Information Security and Data Protection.

Benefits

• Flexible/hybrid working.
• Company pension.
• Life insurance.
• Private healthcare.
• Health Cash Plan.
• Enhanced maternity and paternity pay.
• Employee purchase scheme.
• Group bonus scheme.
• Company music events, offsite company parties and free lunch.
• Company training sessions and encouragement of personal development.