Information Security Officer (ISO)

One role, many institutions: help universities, colleges and public bodies across the UK build real cyber resilience.

Location: Remote, UK-wide, with occasional on-site member meetings and in-service days

Hours: Full time, 35.625 hours per week, 9.5-day fortnight

Reports to: Head of Cyber Security Services

About Us

HEFESTIS is a not-for-profit, member-owned cyber security shared service supporting education and public sector organisations across the UK. Through a collaborative delivery model, we help our members strengthen governance, manage cyber risk, improve resilience and build confidence in their ability to respond to an evolving cyber threat landscape. Our wider ecosystem includes established relationships with Scottish Government’s SC3, Acumen Cyber and Toronto Metropolitan University, giving members access to complementary expertise, capability and sector insight where needed.

Our CISO Office brings strategic cyber leadership, engagement management and operational delivery together in a single service. Chief Information Security Officers set direction and provide oversight, while Information Security Officers turn that direction into practical, measurable progress. This combination of leadership, hands-on support and access to a wider network of specialist capability helps members strengthen cyber resilience without having to build every capability themselves.

Position Overview

As an Information Security Officer (ISO) in our CISO Office, you will report to the Head of Cyber Security Services (Managing CISO).

Working alongside our CISOs and member stakeholders, you will provide the day-to-day delivery and coordination that turns agreed priorities into practical output and sustained activity. You will run assessments, manage evidence, produce deliverables and keep member cyber security programmes moving. This is not an administrative or document-production role. It is a delivery role. You will help members translate cyber security advice into organised, repeatable, measurable activity and resilience.

Key Responsibilities

The exact mix depends on the service agreed with each member.

Member Engagement and Delivery

• Support member onboarding, discovery and baseline reviews.
• Work with member IT, Digital and Cyber teams, suppliers and the supporting CISO to progress agreed activities.
• Track actions, dependencies, decisions and delivery milestones.
• Escalate risks, delays and decisions that need CISO or member attention.

Assessment

• Deliver capability, resilience, risk and control assessments against recognised standards.
• Collect, review and organise supporting evidence.
• Support evidence-based reviews of control coverage and effectiveness.

Governance

• Produce and maintain policies, standards, procedures, strategies and roadmaps.
• Maintain risk, action, decision and evidence records.
• Support the operation of member governance and risk-management arrangements.

Strengthening

• Support and coordinate delivery of agreed improvement plans across our Omega (governance and assurance), Delta (operational improvement) and Sigma (advanced optimisation) Pathways.
• Help members implement and embed agreed policies, processes and ways of working.

Preparing

• Coordinate cyber exercises, tabletop exercises, workshops and governance forums that build members’ incident readiness, alongside the CISO Office team.

Assurance and Reporting

• Prepare reports, management information and service scorecards.
• Maintain service records and programme documentation.
• Contribute to the continual improvement of CISO Office services, templates and delivery methods.

Qualifications and Experience

We’re looking for an organised, delivery-focused security professional who gets things done and brings others with them. Strong mid-level candidates are encouraged to apply.

You will bring

• Solid experience in information security and risk management, ideally in a client-facing, consulting or shared-service setting.
• A track record of delivering security assessments and building governance documentation such as policies, standards and procedures.
• Experience managing evidence, risk registers and action tracking through to completion.
• Strong organisation and coordination skills, with the ability to manage multiple member engagements at once.
• Clear written and verbal communication, and the confidence to work with stakeholders from technical teams to senior leaders.
• A self-starter with a growth mindset, comfortable working remotely and collaboratively within a team.

Technical knowledge and professional credentials

• Bachelor’s degree in Information Security, Computer Science or a related discipline, or equivalent professional experience.
• Relevant certifications such as CISSP, CISM, CISA, CRISC or equivalent, or working towards them. ISO 27001 Lead Implementer or Lead Auditor is desirable.
• Practical knowledge of recognised frameworks and standards, including ISO 27001, NIST CSF, NCSC CAF, CIS Controls, Cyber Essentials / Cyber Essentials Plus and UK GDPR.
• Experience in higher education, further education or the public sector is advantageous but not essential.

Eligibility requirements

• Existing right to work in the UK.
• Ability to obtain DBS clearance.
• We are unable to offer visa sponsorship.

What We Offer

Why join HEFESTIS?

• Real delivery responsibility across a diverse portfolio of universities, colleges and public sector organisations.
• The support of a collaborative CISO Office, working alongside experienced CISOs and ISOs.
• A clear route to develop your skills through structured pathways, from assurance through to advanced, threat-informed and resilience-focused practice.
• The opportunity to shape and develop new cyber services, working alongside other HEFESTIS services and our strategic partners to create joined-up solutions for members.
• The chance to make a measurable difference to cyber resilience across the UK education and public sector.

Benefits

• Competitive salary.
• Pension scheme.
• 40 days holiday, made up of annual leave and fixed leave entitlement.
• 9.5-day fortnight as standard, with every second Friday afternoon off.
• Remote-first working.
• Investment in your professional development and certifications.
• Access to the company benefits suite, including cycle-to-work scheme and gym discounts.

Application Process

Please send your CV and a covering letter outlining your relevant experience via the 'Apply' button above (e: jobs@hefestis.ac.uk) by 29th November 2026.

HEFESTIS Ltd is an equal opportunity employer and encourages applications from individuals of all backgrounds and experiences.

Your data will be handled in line with UK GDPR.