Information Security Manager

This job is with Xceptor, an inclusive employer and a member of my Gwork – the largest global platform for the LGBTQ+ business community.

Please do not contact the recruiter directly.

ABOUT XCEPTOR Data is at the heart of everything we do: Xceptor has been designed around data manipulation in its broadest sense.

We source data from wherever it flows.

We curate, normalise, validate, repair, and enrich that data so it reaches its destination in a reliable and consistent format.

Data coming out of Xceptor is data our clients can trust.

We are recognised as an expert in the Financial Services vertical, which strongly aligns with Business Users in Middle and Back-Office teams.

We enable these users to solve their data challenges by themselves, rather than through a technology-led project.

Our mission - we empower business users within financial institutions to build automated processes that deliver trusted data.

Our values sit at the heart of our business, driving who we are and how we work.

At Xceptor, we are: Client Centric; we prioritise our Clients’ experience and needs.

One Team; we actively support one another to achieve our goals.

Impactful; we focus, we innovate, we make every minute matter. 🚀 Your

Role: We’re seeking an experienced, highly independent Info Sec/GRC professional to lead information security across the business and own our ISO/IEC 27001 and SOC 2 programmes end to end.

You’ll be the single accountable owner for audit readiness, evidence quality, stakeholder coordination and continuous improvement, working hands-on without a supporting team.

Beyond compliance, you’ll build an internal culture of security and compliance, manage security incidents, work with the business on vulnerability management, and advise senior leadership on risk. 🧩 What You’ll

• Doing: Security leadership and culture
• Build and champion and information security and compliance culture across the business.
• Advise business and senior leadership on security risks, priorities, and decisions.
• Run periodic information security meetings and maintain governance and reporting: the audit and compliance calendar, risk register, findings tracker, KPIs/KRIs, and regular leadership updates.
• Maintain our information security policies, standards, and procedures.
• Own and operate the ISMS: scope, risk management, Statement of Applicability, policies and standards, management reviews, corrective actions and continual improvement.
• Plan and manage the internal audit program.
• Lead external certification audits (Stage 1, Stage 2 and surveillance): auditor management, PBC coordination, evidence presentation and remediation closure.
• SOC 2
• Own scoping and readiness, and maintain the control matrix, control narratives, evidence catalogue and testing calendar.
• Lead Type I and Type II audits with the CPA firm, ensuring timely, complete, high-quality evidence and responses.
• Controls and operations
• Build an integrated control library that minimizes duplication across ISO 27001 and SOC 2 and keep controls “operating in reality”.
• Drive cross-functional control ownership (Engineering, IT, Product, HR, Finance, Legal, Ops) through clear requirements, timelines and follow-up.
• Manage information security incidents, from response through to lessons learned.
• Work with business counterparts on vulnerability management, including prioritization and remediation.
• Customer and supplier assurance
• Help with RFPs, security questionnaires, and due diligence packs.
• Support supplier security and evidence sharing aligned to our frameworks.
• Customer and supplier assurance
• Help with RFPs, security questionnaires and due diligence packs.
• Support supplier security and evidence sharing aligned to our frameworks. 🎯 Who we're looking for: 7-10+ years in information security, GRC, risk, or audit/compliance roles.

Experience in Saa S/technology environments.

Demonstrable end-to-end ownership of: ISO 27001 certification (not just support), including the internal audit program and management review and SOC 2 audits (Type II strongly preferred).

Experience managing information security incidents and advising senior stakeholders.

Proven ability to operate autonomously and drive outcomes without a team.

A strong evidence-based mindset: you know what auditors look for and how to structure documentation and artefacts accordingly.

ISO 27001 clause and Annex A control expertise, with internal audit planning and execution.

SOC 2 Trust Services Criteria experience (control design and operating effectiveness).

Strong documentation skills (policies, standards, procedures, control narratives).

Excellent stakeholder management, communication, prioritisation and programme organisation.

Solid understanding of common security controls (IAM, change management, vulnerability management, logging, incident response, BCP/DR, vendor security).

Preferred Experience ISO 27001 Lead Auditor or Lead Implementer, CISSP, CISA, CRISC (or equivalent).

Experience in modern tooling (Wiz, Drata/Vanta or similar, GRC platforms). 🌍 Diversity