Senior Information

Senior Cyber and Information Security Manager role with a national law firm. You will define and deliver the security strategy and roadmap, acting as a trusted advisor on cyber risk and governance. You’ll own the ISMS and lead adoption of ISO 27001, NIST CSF, and Cyber Essentials Plus while overseeing security operations and incident response. The role involves managing suppliers, supporting client audits, and driving a security‑first culture through a small team. Hybrid work from Bristol or Southampton enables collaboration with cross‑functional partners to strengthen the firm’s security posture.

• hybrid and flexible working
• enhanced parental leave policies
• private healthcare
• wellbeing initiatives

• Define and deliver the cyber and information security strategy and roadmap
• Act as trusted advisor to senior leaders on cyber risk, governance and compliance
• Own and enhance the Information Security Management System (ISMS)
• Lead implementation of ISO 27001, NIST CSF, Cyber Essentials Plus and security best practices
• Oversee security operations, incident response and threat management
• Manage security suppliers, partners and MSPs
• Support client audits, due diligence requests and regulatory requirements
• Drive security awareness and embed a security‑first culture
• Lead and develop a small team of Cyber and Information Security professionals
• Collaborate with Technology, Risk, Compliance and business teams to strengthen security posture

• Significant experience in a senior cyber or information security role
• Experience in a regulated or professional services environment
• Strong knowledge of ISO 27001, NIST CSF, Cyber Essentials Plus and governance frameworks
• Hands-on experience across risk management, incident response and security operations
• Proven ability to engage and influence senior stakeholders
• Experience leading or developing security professionals
• Strong understanding of GDPR and data protection principles
• Proactive, pragmatic and solutions‑focused approach
• CISM or CISSP

• stakeholder engagement
• leadership
• communication
• ISO 27001
• NIST CSF
• Cyber Essentials Plus