Information Security Manager

🚀 Your Role:

We’re seeking an experienced, highly independent InfoSec/GRC professional to lead information security across the business and own our ISO/IEC 27001 and SOC 2 programmes end to end.

You’ll be the single accountable owner for audit readiness, evidence quality, stakeholder coordination and continuous improvement, working hands-on without a supporting team.

Beyond compliance, you’ll build an internal culture of security and compliance, manage security incidents, work with the business on vulnerability management, and advise senior leadership on risk.

🧩 What You’ll Be Doing:

Security leadership and culture
•    Build and champion and information security and compliance culture across the business.
•    Advise business and senior leadership on security risks, priorities, and decisions.
•    Run periodic information security meetings and maintain governance and reporting: the audit and compliance calendar, risk register, findings tracker, KPIs/KRIs, and regular leadership updates.
•    Maintain our information security policies, standards, and procedures.

ISO 27001
•    Own and operate the ISMS: scope, risk management, Statement of Applicability, policies and standards, management reviews, corrective actions and continual improvement.
•    Plan and manage the internal audit program.
•    Lead external certification audits (Stage 1, Stage 2 and surveillance): auditor management, PBC coordination, evidence presentation and remediation closure.

SOC 2
•    Own scoping and readiness, and maintain the control matrix, control narratives, evidence catalogue and testing calendar.
•    Lead Type I and Type II audits with the CPA firm, ensuring timely, complete, high-quality evidence and responses.

Controls and operations
•    Build an integrated control library that minimizes duplication across ISO 27001 and SOC 2 and keep controls “operating in reality”.
•    Drive cross-functional control ownership (Engineering, IT, Product, HR, Finance, Legal, Ops) through clear requirements, timelines and follow-up.
•    Manage information security incidents, from response through to lessons learned.
•    Work with business counterparts on vulnerability management, including prioritization and remediation.

Customer and supplier assurance
•    Help with RFPs, security questionnaires, and due diligence packs.
•    Support supplier security and evidence sharing aligned to our frameworks.

Customer and supplier assurance
•    Help with RFPs, security questionnaires and due diligence packs.
•    Support supplier security and evidence sharing aligned to our frameworks.

🎯 Who we're looking for:

• 7-10+ years in information security, GRC, risk, or audit/compliance roles.
• Experience in SaaS/technology environments.
• Demonstrable end-to-end ownership of: ISO 27001 certification (not just support), including the internal audit program and management review and SOC 2 audits (Type II strongly preferred).
• Experience managing information security incidents and advising senior stakeholders.
• Proven ability to operate autonomously and drive outcomes without a team.
• A strong evidence-based mindset: you know what auditors look for and how to structure documentation and artefacts accordingly.
• ISO 27001 clause and Annex A control expertise, with internal audit planning and execution.
• SOC 2 Trust Services Criteria experience (control design and operating effectiveness).
• Strong documentation skills (policies, standards, procedures, control narratives).
• Excellent stakeholder management, communication, prioritisation and programme organisation.
• Solid understanding of common security controls (IAM, change management, vulnerability management, logging, incident response, BCP/DR, vendor security).

Preferred Experience

• ISO 27001 Lead Auditor or Lead Implementer, CISSP, CISA, CRISC (or equivalent).
• Experience in modern tooling (Wiz, Drata/Vanta or similar, GRC platforms).

🌍 Diversity & Inclusion at Xceptor

We believe great ideas come from everywhere — and that the best teams are made up of people with different backgrounds, experiences, and perspectives. At Xceptor, we’re committed to building a workplace where everyone feels welcome, valued, and empowered to be themselves.

We know that not everyone ticks every single box in a job description — and that’s okay. If you’re excited about this role and think you could make a difference, we’d love to hear from you. Your unique skills and experiences might be just what we need, even if you don’t meet every requirement.

We celebrate diversity and are dedicated to creating an inclusive environment for all employees — regardless of race, gender identity, sexual orientation, age, disability, religion, or background.

🌗 Hybrid at Xceptor