Lead Information Security Officer

Application Deadline: 31 October 2026

Department: Risk and Compliance

Employment Type: Permanent - Full Time

Location: Pune

Description

Key Responsibilities

• Provide line management, coaching, objective setting, performance support and professional development for the whole Information Security team, including colleagues working across locations and time zones.
• Plan, prioritise and allocate team activity, monitor delivery against agreed objectives and ensure consistent quality, service and governance standards.
• Act as the primary escalation point for Information Security risks, issues and incidents, escalating material matters to the Group Head of Cyber and supporting out-of-hours response where required.
• Lead the development, review and implementation of Information Security governance processes, policies, standards and control requirements in response to business change, emerging threats, legislation and regulation.
• Lead the Information Security risk management approach, ensuring risks are identified, assessed, recorded, treated, monitored and reported across the Group.
• Lead complex information security and third-party risk assessments, balancing technical, physical, procedural and people controls with business needs and risk appetite
• Lead the production of Information Security requirements for suppliers, business initiatives and compliance activities, working with the wider Governance, Risk and Compliance function to ensure risks are appropriately managed.
• Lead the Information Security training and awareness programme, ensuring colleagues understand their security responsibilities and how their work supports organisational objectives.
• Provide pragmatic Information Security advice and challenge to senior stakeholders, programmes, projects and operational teams, enabling secure business decisions.
• Own the production and quality assurance of monthly Information Security risk dashboards, KPI and KRI reporting, and executive and Board-level updates.
• Support internal and external audits, regulatory reviews and customer assurance activities, ensuring evidence, remediation actions and responses are complete, accurate and timely.
• Support security incident response, lessons learned and control improvement activities, coordinating Information Security input with Cyber Security, Privacy, Data Governance, Technology and business teams.
• Promote effective collaboration across Cyber Security, Information Assurance, Privacy, Data Governance and the wider GRC function to maintain a cohesive approach to security risk management.
• Deputise for the Group Head of Cyber on Information Security matters where required.

Skills, Knowledge and Expertise

• Minimum 10 years’ experience across Information Security, cyber security, governance, risk or compliance roles within large or complex organisations.
• Demonstrable experience leading and developing geographically distributed teams, including effective remote line management.
• Significant experience implementing and maintaining global Information Security and cyber risk frameworks, including ISO/IEC 27001, NIST Cybersecurity Framework and CIS Controls.
• Bachelor’s degree in Information Security, Cyber Security, Information Technology, Risk Management or a related discipline, or equivalent relevant professional experience.
• Experience working in regulated sectors and engaging with senior management, auditors, regulators, customers and third parties.
• Strong working knowledge of Information Security governance, risk management, control design, policy management, security awareness and third-party assurance. 
• Ability to translate complex security, regulatory and risk matters into clear, proportionate and actionable business advice. 
• Excellent leadership, coaching, delegation, workload planning and team development capability. 
• Ability to lead complex risk assessments and provide credible challenge to senior stakeholders. 
• Strong knowledge of global security regulations, recognised security frameworks and industry good practice. 
• Experience producing meaningful executive and Board-level dashboards, metrics and risk reporting. 
• Security incident response experience and an understanding of the interaction between governance, operational security and technology controls. 
• Strong stakeholder and supplier relationship management skills across global and multicultural environments. 
• Commercial awareness and the judgement to balance business enablement with appropriate protection of information and services.
• Excellent written and verbal communicator, able to adapt style for technical, non-technical and executive audiences.
• Proven people leader with a collaborative, service-led and accountable approach.
• Confident decision-maker who can prioritise competing demands and operate effectively under pressure.
• Strong documentation, analytical and problem-solving skills.
• Pragmatic and proportionate risk mindset, with the confidence to challenge constructively.
• Experience working within highly regulated businesses.
• Flexible approach to working hours to support a global team and material security incidents when required.
• Commitment to continuous professional development and sharing good practice across the team.
• One or more relevant professional certifications, such as CISM, CISSP, CRISC or ISO/IEC 27001 Lead Implementer or Lead Auditor, is highly desirable.
• Active membership of a recognised professional body, or equivalent evidence of continuing professional development, is desirable.