ISMS Manager in Birmingham

We are looking to appoint a senior role to lead both the implementation and ongoing management of our ISO 27001 accreditation. This role will play a key part in designing and embedding the management system, before taking full ownership of its day-to-day operation, governance, and continuous improvement. Working closely with IT, Professional Standards and teams across the business, the role will ensure controls are robust, risks are effectively managed, and audit requirements are consistently met.

There will be a significant focus on implementation in the initial phase, transitioning into long-term ownership of the standard. This includes driving compliance, leading audit activities, overseeing risk management, and delivering clear reporting, alongside embedding a culture of information security across the organisation.

Candidates must have strong working knowledge of ISO 27001 and demonstrable experience in implementing and managing compliant information security management systems. You will develop a strong understanding of Gateley’s ISO 27001 accreditation and play a central role in both its implementation and ongoing management.

Key Responsibilities:

• Leading the implementation, embedding and ongoing management of the ISO 27001 Information Security Management System (ISMS).
• Managing, maintaining and continuously improving ISO 27001 certification, ensuring ongoing compliance with the standard.
• Owning and developing the firm’s ISO 27001 documentation, ensuring policies, procedures, records and controls are robust, up to date and effectively managed.
• Leading internal audit activity, including planning, execution, reporting and ensuring timely closure of actions, with clear updates to senior stakeholders.
• Preparing for and managing external audits, acting as the primary point of contact for assessors and coordinating internal stakeholders.
• Chairing and supporting governance forums, including preparing agendas, papers, and tracking actions through to completion.
• Providing expert guidance to teams across the business on ISO 27001 and information security requirements, ensuring controls are understood and consistently applied.
• Driving awareness and engagement across the organisation to embed a strong information security culture.
• Managing client and supplier assurance activity, including responding to ISO 27001 security questionnaires and due diligence requests.
• Working closely with IT, Professional Standards, Risk, HR and Operations to ensure controls are effectively embedded and operating as intended.

Risk Management Coordination:

• Leading the implementation and ongoing oversight of the ISO 27001 risk management framework and associated documentation.
• Driving risk identification, assessment, treatment and monitoring activities across the business.
• Working closely with risk owners to ensure risk registers, incident logs and supporting records are accurate, up to date and effectively managed.
• Facilitating regular risk reviews and ensuring timely progression of mitigation and improvement actions.

Quality & Continuous Improvement:

• Championing high standards of governance, documentation and control effectiveness across the ISMS.
• Identifying and driving opportunities to strengthen processes, controls and ways of working.
• Embedding a culture of continuous improvement across information security practices, aligned to ISO 27001 requirements.

This role will take a leading position in both the implementation and subsequent ownership of ISO 27001, with a strong focus on embedding sustainable controls, maintaining compliance, and driving ongoing improvement across the organisation.

The team at Gateley Plc is a dynamic and collaborative environment where innovation thrives. Over recent years, we have expanded our team to include over 60 professionals who are dedicated to driving technological excellence and delivering innovative solutions. Our diverse team is structured across several key areas: IT Service, Infrastructure, Architecture, Security, Change Management, Engineering, Innovation and Client Solutions.

We value collaboration, continuous learning, and professional growth. This role will work in close partnership with the Professional Regulations and Standards team, ensuring a joined-up and consistent approach to governance, compliance, and risk management across the business.

The person:

• Strong working knowledge of ISO 27001, with demonstrable experience implementing and managing compliant information security management systems.
• Proven ability to design, embed and improve governance, controls and documentation within a regulated or professional services environment.
• Excellent attention to detail, with a focus on accuracy, quality and control effectiveness.
• Strong stakeholder management and communication skills, with the ability to influence and challenge at all levels of the business.
• Ability to manage multiple priorities independently, with a proactive and structured approach.
• Experience of planning, leading and chairing meetings, including governance forums.
• Comfortable working cross-functionally, building effective relationships across IT, Risk, HR and Operations.
• High levels of professionalism, discretion and integrity when handling sensitive information.
• Ability to work effectively under pressure and respond to changing priorities within a delivery environment.
• Strong organisational and documentation management skills, including experience with Microsoft Office and document management systems.

Desirable / Beneficial:

• Degree-level education or equivalent professional experience.
• Experience working with ISO management systems, particularly ISO 27001, with working knowledge of ISO 9001 beneficial.
• Experience within a professional services or regulated environment.
• Strong understanding of regulatory and compliance frameworks within a legal or professional services business.
• Ability to operate across multiple standards and frameworks where required, supporting broader quality and compliance initiatives.

This job description is not an exhaustive list due to the requirements of the role. Therefore, the job holder may be required from time to time to carry out other ad hoc tasks as requested.