• Role: Senior Cyber and Information Security Manager
• Team: IT – Technology Operations
• Location: Hybrid working from Bristol, Exeter, Plymouth, or Southampton
• This role will require travel to Southampton twice a month, or as per business need
• Working Pattern: Full-time
• Why this role matters: This is a pivotal opportunity to shape and lead our cyber and information security strategy, protecting our people, systems and client data whilst ensuring we remain ahead of evolving threats, regulatory requirements and client expectations.
• 
  

________________________________________What you’ll do As our Senior Cyber and Information Security Manager, you’ll lead the continued development of our cyber and information security function within our growing national law firm.In this role, you’ll:

• Define and deliver our cyber and information security strategy and roadmap.
• Act as a trusted advisor to senior leaders on cyber risk, governance and compliance.
• Own and continually enhance our Information Security Management System (ISMS).
• Lead our approach to ISO 27001, NIST CSF, Cyber Essentials Plus and wider security best practice.
• Oversee security operations, incident response and threat management activities.
• Manage key security suppliers, partners and managed service providers.
• Support client audits, due diligence requests and regulatory requirements.
• Drive security awareness and embed a security-first culture across the firm.
• Lead and develop a small team of Cyber and Information Security professionals.
• Work collaboratively with Technology, Risk, Compliance and business teams to strengthen our security posture.
• 
  

This is a highly visible role offering the opportunity to influence strategy, shape security culture and play a key role in our ongoing growth journey.________________________________________What we’re looking for We’re looking for an experienced cyber and information security professional who combines technical expertise with strong stakeholder management and leadership skills.You’ll bring:

• Significant experience in a senior cyber or information security role.
• Experience within a regulated or professional services environment.
• Strong knowledge of ISO 27001, NIST CSF, Cyber Essentials Plus and security governance frameworks.
• Hands-on experience across risk management, incident response and security operations.
• Proven ability to engage, influence and build credibility with senior stakeholders.
• Experience leading, mentoring or developing security professionals.
• A strong understanding of GDPR and data protection principles.
• A proactive, pragmatic and solutions-focused approach.
• 
  

QualificationsWe’ll broaden your horizons

The Quality and Risk Management Team (QRMT) at BDO comprises several sub-teams including the Legal Team, CISO, Enterprise Risk Management, Economic Crime, Quality Management, Ethics and Independence and Advisory and Compliance. It provides Partners and staff with the guidance, tools and support to enable them to identify and manage quality and risk issues. The QRMT is led by the Head of Quality and Risk Management Team, who is a partner who reports into the Head of Quality and Risk for the firm and sits on the BDO Leadership Team.

We’ll help you succeed

Leading organisations trust us because of the quality of our advice. That quality grows from a thorough understanding of their business, and that understanding comes from working closely with them and building long-lasting relationships.

You’ll be someone who is both comfortable working proactively and managing your own tasks, as well as confident collaborating with others and communicating regularly with senior managers, directors, and BDO’s partners to help businesses effectively. You’ll be encouraged to identify and draw attention to opportunities for enhancing our delivery and providing additional services to organisations we work with.

Role purpose:

Reporting to CISO the Information Security Senior Manager is a subject-matter role responsible for designing and maintaining a structured, documented and evidence-based ISO27001 information security management systems and professional services aligned controls framework across the firm. The role provides strong expertise in Information security risk management to ensure controls are appropriately designed, implemented, operated and demonstrably effective.

Principal accountabilities:

• Design, maintain and continuously improve an information security controls framework aligned with the firm’s strategy, risk appetite, policies, legislation, regulatory obligations, client commitments and recognised standards.
• Develop and maintain information security policies and the supporting standards, procedures and guidance that form part of the firm’s Information Security Management System.
• Coordinate and evidence the annual review of the Information Security Management System, identify improvements, agree proportionate actions and monitor findings through to closure.
• Plan, coordinate and support internal audits of compliance with ISO 27001 and related requirements, ensuring identified exposures and non-conformities are assessed, remediated and verified.
• Define clear control objectives, requirements, ownership, evidence standards, compliance approaches and effectiveness criteria, ensuring traceability from risks, policies, legislation and standards to control implementation.
• Lead compliance reporting and remediation initiatives, coordinating across Information Technology, Human Resources, Risk, Legal, Data Protection, Internal Audit and business functions.
•