Head of Information Security

Working closely with Engineering Workplace Technology Compliance Legal Risk Product and senior leadership this role will be responsible for:

• Owning and delivering Moneyboxs information security strategy roadmap and operating model.

• Leading the ongoing development of Moneyboxs Information Security Programme using NIST CSF as the practical risk-management framework while aligning with ISO 27001 for governance control maturity and assurance.

• Reducing real security risk across Moneyboxs technology estate people processes suppliers and products.

• Building an effective and focused security function that scales through prioritisation tooling automation and clear ways of working

• Providing clear practical security leadership to senior stakeholders including regular reporting on security posture risks incidents and priorities.

• Making proportionate risk-based decisions that support business growth while protecting customers and the organisation.

• Developing maintaining and embedding practical information security policies standards and procedures.

• Leading security awareness and training programmes that improve behaviours and strengthen Moneyboxs security culture.

• Owning Moneyboxs security incident response framework ensuring the business is prepared to identify contain respond to and recover from security incidents effectively.

• Overseeing vulnerability management including scanning remediation patching and risk-based prioritisation.

• Leading third-party security risk management for key vendors partners and technology providers.

• Defining and tracking security metrics that support risk reduction delivery progress and decision-making

• Partnering with Engineering and Product teams to ensure security is built into systems services and ways of working.

• Monitoring emerging threats regulatory expectations and industry practice then applying them pragmatically to Moneyboxs environment.

• Continuously improving the security function in a way that is practical proportionate and appropriate for Moneybox

• A strategic but hands-on information security leader.

• Comfortable owning outcomes directly and staying close to delivery.

• Pragmatic and risk-led with strong judgement on where security effort will have the greatest impact.

• Comfortable building security capability through focus prioritisation technology and automation.

• Able to prioritise security effort based on risk impact and business context.

• Commercially aware with the ability to balance security customer experience regulation and delivery.

• Clear and concise with senior stakeholders able to translate security issues into business impact.

• Collaborative and able to influence across Engineering Compliance Legal Product Workplace Technology and the wider business.

• Strong understanding of current and emerging threats and how to manage them proportionately in a fast-moving organisation.

• Interested in how AI and automation can improve security operations assurance monitoring reporting and decision-making.

• Alert to the security risks created by AI adoption including data exposure misuse shadow AI third-party tooling and changing attacker capabilities.

• Motivated by building a high-quality security function that fits Moneybox rather than importing a large-enterprise or big-bank model.

• Proven experience leading or significantly contributing to an information security function.

• Strong working knowledge of risk-based security management and the NIST Cyber Security Framework.

• Experience developing and delivering information security strategy roadmaps policies and controls.

• Practical knowledge of security technologies and business systems including identity and access management SIEM endpoint security cloud security vulnerability management and remote working technologies.

• Experience using technology automation or AI to improve security outcomes or operational efficiency.

• Experience managing security risk in cloud-based environments ideally including Azure.

• Strong understanding of third-party security risk management.

• Experience with incident response planning testing and improvement.

• Experience reporting security risks controls and metrics to senior management.

• Strong communication skills with the ability to translate technical security issues into clear business risks recommendations and trade-offs for senior stakeholders.

• Good understanding of financial services security risk and regulatory expectations.

• Demonstrated leadership skills with the ability to influence collaborate and drive change across teams.

• Excellent written and spoken English.