Global IT Manager, Security & Compliance

Compliance and Risk

• Own the IT evidence program across ISO 27001:2022, SOC 1, SOC 2, PCI DSS, and HIPAA for a portfolio of approximately thirteen operating sites.

• Act as IT's counterpart to external certification bodies and auditors — prepare for audits, present and defend control evidence, and own remediation of IT findings through to closure.

• Manage third-party and vendor risk management for IT: vendor security assessments, a maintained vendor register with periodic reassessment.

• Own customer-facing security due diligence — questionnaires, audits and assessments.

• Maintain the IT risk register and opportunities-for-improvement log, and drive items to closure rather than allowing them to age.

• Coordinate IT participation in business continuity and disaster recovery testing, and ensure results are documented.

Security Operations

• Manage vulnerability management end to end — scanning coverage, triage, remediation ownership, escalation of anything aging, and periodic reporting to leadership.

• Work along side counterparts to oversee endpoint detection and response and the security alerting pipeline; ensure alerts reach an owner and that investigations are recorded and closed.

• Lead security incident response — containment, investigation, root cause, customer-facing incident reporting, and post-incident hardening.

• Manage email security, including domain authentication posture and secure email gateway configuration.

• Run the security awareness program — monthly phishing simulation, results analysis, and targeted follow-up.

Identity and Access

• Contribute to identity governance across a hybrid estate spanning cloud and on-premises IdP

• Oversee access review cadence, privileged access controls, and the joiner-mover-leaver process from an IT control standpoint, including third-party and contractor access.

• Eight or more years in information security, IT compliance, or IT risk, with meaningful time spent in both compliance and technical security work.

• Demonstrated ownership of an ISO 27001 program, including direct experience preparing for and defending findings with an external certification body.

• Hands-on experience with at least two of: SOC 2, PCI DSS, HIPAA, NIS2, or DORA.

• Genuine technical depth — you should be comfortable reading firewall and authentication logs, assessing a vulnerability scan, evaluating an OAuth consent request, and challenging an engineer's proposed remediation on its merits.

• Experience with vulnerability management platforms, endpoint detection and response tooling, and enterprise identity platforms.

• Experience leading security incident response through to a customer-facing or executive-facing conclusion.

• Ability to communicate risk credibly to both engineers and executives, and to hold vendors and internal stakeholders accountable without formal authority over them.

• Willingness to travel to sites periodically for audit, assessment, and control validation.