Information Security Risk Manager

Information Security Risk Manager (IT Risk Manager)

City of London (Hybrid Working)

£90,000 - £105,000 + Bonus (20%-30% Annually) & Benefits

A leading financial services (Commodities Trading & Risk Management) organisation is seeking an experienced Information Security Risk Manager (ISRM) to join its Operational Resilience function as a Second Line of Defence specialist.

This is a senior risk-focused position responsible for independently assessing, challenging and reporting on information security, technology, cyber and third-party risks across the organisation. The role will provide independent oversight and assurance, helping the business understand its risk exposure, assess the effectiveness of controls and make informed decisions within its risk appetite.

Importantly, this is not a traditional Information Security Manager role. It is not a hands-on engineering, architecture or security operations position. Instead, the successful candidate will provide credible, evidence-based challenge to Technology and First Line teams, ensuring that security risks are properly understood and that reported control effectiveness is supported by appropriate evidence.

Reporting to the Head of Operational Resilience the role will lead and continuously develop the organisation's Information Security Risk capability. It will work closely with Business Continuity & Crisis Management, Third Party Risk Management, Data Governance & Privacy and ICT Risk Governance teams to ensure technology and cyber risks are effectively managed across the organisation.

The Role

The Information Security Risk Manager will independently assess technology, cyber, data and supplier risks, review proposed controls, identify control weaknesses, assess residual risk and provide recommendations for appropriate mitigation.

The role will not own technology controls or accept risks on behalf of the business. Instead, it will provide the independent assessment, assurance and challenge required to support informed risk decisions.

A key component of the position will be security control assurance. The successful candidate will independently validate whether security controls are appropriately designed and operating effectively through evidence review, testing and constructive challenge.

Key Responsibilities

• Independently assess information security, technology, cyber and third-party risks.
• Translate technical risks into clear business, operational resilience and regulatory impacts.
• Provide evidence-based challenge to First Line Technology and business teams.
• Assess inherent and residual risk against the organisation's risk appetite.
• Review security control design and independently assess control effectiveness.
• Challenge remediation activity, prioritisation and risk treatment decisions.
• Review vulnerability management, penetration testing, patching, monitoring and security assurance outputs.
• Identify systemic control weaknesses, emerging risks and areas of increased exposure.
• Support cyber incident response, resilience planning and scenario testing.
• Provide independent challenge during cyber incidents and recovery activities.
• Develop and continuously improve the Information Security Risk framework, methodologies and governance processes.
• Produce meaningful risk reporting, MI and KRIs for senior management and governance forums.
• Support regulatory obligations including DORA, FCA Operational Resilience and GDPR.
• Ensure the Information Security Risk framework remains aligned with recognised standards including NIST CSF and ISO 27001.
• Support internal and external audit, regulatory assessments and remediation programmes.
• Contribute to cyber awareness and phishing simulation programmes.
• Work collaboratively across Operational Resilience, Technology, Data Governance, Privacy, Third Party Risk and Business Continuity functions.

In simple terms, the organisation is looking for someone who can independently assess cyber and technology risks, validate that controls are working as intended, challenge First Line assumptions, support cyber incident and resilience activities, and provide trusted risk-based advice to senior management and the wider business.