Role Overview #

Job Title: Information Security Risk Manager Department/Team: Information Security Reporting To: Head of Information Security Risk and Governance Grade/Band: To be defined

Purpose of the Role #

Purpose Statement: #

To identify, assess, and manage security risks across the organization by implementing and maintaining an Information Security Risk Management Framework, conducting risk assessments, and ensuring mitigation measures are in place. This role supports the organization’s compliance with regulatory requirements and strengthens its overall security posture.

Main Duties and Responsibilities #

Key Responsibilities: #

• Develop, maintain, and implement the Information Security Risk Management Framework.
• Conduct regular risk assessments across business units, identifying, analyzing, and prioritizing security risks.
• Collaborate with stakeholders to define risk tolerance levels and implement appropriate mitigation strategies.
• Prepare and present detailed risk reports to senior management, outlining findings and recommendations.
• Ensure compliance with relevant regulations and standards (e.g., ISO 27001, NIST CSF, GDPR).
• Oversee the risk treatment process, monitoring risk mitigation progress and validating implemented controls.
• Promote risk awareness across the organization through targeted training and communication initiatives.
• Support internal and external audit processes, providing evidence of risk controls and addressing findings.
• Drive continuous improvement by identifying opportunities to enhance risk management processes.
• Evaluate risks related to new projects, emerging technologies, and third-party engagements.