Head of InfoSec @ Centellic

The Head of Information Security is responsible for establishing, owning, & driving the global information & cyber security strategy for Centellic. This role provides leadership, governance, & oversight across cyber security, information security, risk management, business continuity, disaster recovery and customer assurance (DDQs). This position will oversee all security operations, develop enterprise security policies & frameworks, manage third-party risk and lead resilience planning. The Head of Information Security will directly manage the Information Security team and act as the senior authority for cyber & information security within the organisation.

• Strategic Leadership & Governance Develop & own the global information security strategy & roadmap.
• Establish, maintain, & enforce security policies, standards, & procedures.
• Inform stakeholders through reporting on risk, posture, compliance, & incidents.
• Ensure alignment with business strategy, technology transformation, & operational resilience programmes.
• Attend Information Security governance forums & represent security in senior management discussions.
• Liaise with the Data Protection Officer to align security controls with privacy obligations and regulatory requirements.
• Cyber Security & Security Operations Oversight Oversee global SOC operations including monitoring, detection, incident triage, & forensic investigations.
• Ensure advanced protection across Microsoft 365, Azure, Intune, Defender, Sentinel SIEM, Cloudflare, DNS, & on-prem environments.
• Lead the improvement of SIEM engineering, log ingestion, alerting, correlation, & automation.
• Ensure continuous protection of identity, endpoints, networks, & cloud services.
• Incident Response & Threat Management Act as executive owner of the global Incident Response process.
• Lead major incidents, including ransomware, credential compromise, cloud intrusion, web security incidents, or DDoS events.
• Manage RCA, reporting, containment, & lessons-learned processes.
• Maintain, test, & improve incident response plans across UK & US operations.
• Risk Management, Assurance & Compliance Own the global information security risk management framework & risk register.
• Lead all customer assurance & Due Diligence Questionnaire (DDQ) responses.
• Manage compliance with ISO 27001/27002, NIST CSF, SOC 2, CIS, DORA, CE/CE+ requirements.
• Oversee internal/external audits, ensuring evidence collection, remediation tracking, & executive reporting.
• Perform supplier & project risk assessments & approve controls for new systems & services.
• Vulnerability Management & Penetration Testing Own the global vulnerability lifecycle, including scanning, reporting, prioritisation, & validation.
• Manage annual penetration testing programmes, including remediation.
• Ensure ongoing alignment with industry baselines & benchmarks.
• Oversee privileged access reviews & secure configuration governance.
• Business Continuity (BCP) & Disaster Recovery (DR) Own & maintain the enterprise BCP & DR strategy & documentation.
• Ensure regular testing, validation, & continuous improvement across all regions.
• Work IT Op, Product / Tech, & business leaders to enhance resilience.
• Cloud, Infrastructure & Application Security Oversee secure configuration & governance of Azure, M365, identity, networking, servers, & firewalls.
• Ensure that new & existing applications undergo appropriate security assessment & review.
• Govern Cloudflare, WAF, bot management, DNS security, & zero trust implementations.
• Third-Party, Vendor & Customer Assurance Lead vendor security assessments & approve or reject high-risk suppliers.
• Ensure third-party SOC, compliance, & security requirements are met.
• Own the timely & accurate completion of customer security questionnaires, audits, & DDQs.
• People Leadership & Collaboration Directly manage & develop the Information Security Lead Build strong relationships with all functional teams Promote & sustain a strong global “security-first” culture.
• Deliver ELT communication, training, & guidance across the organisation.
• Awareness, Training & Culture Oversee global security awareness programmes, phishing simulations, & targeted training.
• Ensure consistent & high-quality communication across global teams.