Head of Information Security

Head of Information Security

Award Winning Law Firm

London (2 days a week in the office) | Permanent

£100,000 - £120,000 + Annual Bonus & Benefits

An established UK based Law Firm is seeking an experienced Head of Information Security to lead and continually enhance its cyber security capability. Reporting to the CIO, the successful candidate will own the organisation’s cyber security strategy, ensuring information systems, data and services remain secure while supporting business growth, client expectations and regulatory obligations.

This is a senior leadership role combining strategic direction with operational oversight, working closely with technology, data and legal stakeholders to embed security across the organisation.

Key Responsibilities

• Develop and deliver the cyber security strategy, roadmap and maturity improvements, aligned with business objectives and risk appetite.
• Lead security operations, including management of the outsourced Security Operations Centre (SOC), threat detection, incident response, vulnerability management and remediation.
• Own and maintain the ISO 27001 Information Security Management System and Cyber Essentials Plus certification.
• Provide security assurance across cloud, infrastructure, SaaS platforms, data and business applications, embedding security and privacy-by-design principles into technology change.
• Lead information security governance, risk assessments, policies, executive reporting and the Information Security Committee.
• Manage third-party security assurance, supplier risk, client security audits and due diligence requirements.
• Support business continuity, disaster recovery and operational resilience, working with senior legal and business stakeholders on regulatory and compliance matters.
• Advise on the security implications of data, AI and emerging technologies, supporting their safe adoption.
• Lead and develop the Information Security team, external partners and wider security awareness initiatives.

Skills & Experience

• Proven experience in senior information security leadership, ideally within legal, professional services or another regulated environment.
• Demonstrable ownership and continuous improvement of ISO 27001 certification and information security governance.
• Strong experience managing outsourced security providers, SOC services, incident response and specialist security suppliers.
• Broad technical knowledge spanning cloud and Azure environments, infrastructure security, security architecture, vulnerability management and incident response.
• Understanding of UK GDPR, the Data Protection Act, regulatory expectations and client confidentiality requirements.
• Experience providing executive-level risk reporting and influencing senior stakeholders.
• Awareness of security and governance risks associated with AI, data platforms and emerging technologies.
• Excellent leadership, communication and stakeholder management skills, with the ability to balance security requirements against commercial and operational priorities.

CISSP or CISM certification is essential. ISO 27001 Lead Auditor accreditation and project management qualifications would be advantageous.