Head of Information Security

In this role you will own ACT’s enterprise information security strategy and governance at Group level, spanning core operations, digital platforms and client-facing technology. You will define cyber risk appetite, lead threat response, and embed security by design across the technology landscape. As a senior security leader, you will translate business goals into a pragmatic security posture that protects systems and data while maintaining client and regulatory trust. You will drive governance, risk management, and secure cloud/AI initiatives to enable scalable, secure digital capabilities.

• Own group-wide information security strategy and roadmap across core and digital platforms
• Define and maintain cyber risk appetite
• Establish security governance, policies, standards and controls with clear accountability
• Report security posture and incidents to executives and Board
• Embed security-by-design in product/platform development and assess third-party data handling
• Oversee security across SDLC, application, product and SaaS security
• Lead enterprise security risk management and third-party risk
• Direct incident preparedness, response, and crisis management planning
• Secure cloud/infrastructure with Zero-Trust controls in a hybrid environment
• Govern AI/security risk for AI/data platforms and AI-enabled threats
• Ensure GDPR, DORA compliance and coordinate audits/certifications
• Lead security function and develop security culture and capabilities

• Bachelor in Information Security or Computer Science or related field
• 10–15 years in information security/cybersecurity
• At least 5 years in a senior security role with enterprise strategy ownership
• Experience across incident response, cloud/infrastructure security, product/application security and regulatory compliance
• Experience securing client-facing platforms or digital products
• Experience in trading/financial services or data-intensive regulated environments is advantageous
• Strong knowledge of ISO/IEC 27001, NIST CSF, CIS Controls
• Understanding of GDPR, DORA, SOC 2
• CISSP/CISM/CISA or equivalent certifications desirable
• Strong analytical and stakeholder-management skills

• strong communication
• stakeholder management
• ability to translate security risks into business impact
• ISO/IEC 27001
• NIST Cybersecurity Framework
• CIS Controls