Business Information Security Officer (BISO)

The Business Information Security Officer (BISO) is a strategic leader responsible for aligning information security with business strategy, ensuring security risks are effectively managed while enabling growth, innovation, and operational resilience.

Acting as the trusted security advisor to senior business leaders, the BISO influences decision-making, shapes business priorities, and ensures security considerations are embedded within strategic planning, transformation initiatives, and day-to-day operations. The role serves as the primary bridge between the business and security functions, translating enterprise security strategy into practical, risk-based outcomes that support organisational objectives and regulatory obligations.

The BISO provides leadership and oversight of the business area's security risk profile, driving continuous improvement in security maturity, governance, and resilience. Through proactive stakeholder engagement, effective challenge, and strategic insight, the role ensures that security risks and opportunities are clearly understood, appropriately managed, and incorporated into business decision-making.

• Act as the trusted security advisor to senior business stakeholders. Shape and influence business strategy to ensure security considerations are incorporated into growth, transformation, and innovation initiatives from the outset.
• Translate enterprise security strategy into business specific security roadmaps and priorities.
• Ensure security is embedded into business strategy, product development, and transformation initiatives.
• Align security outcomes with business objectives, risk appetite, and regulatory requirements.
• Lead the identification, assessment, and management of business-specific security risks.
• Ensure effective implementation of security policies, standards, and controls within the business.
• Support governance processes, including risk reporting, issue management, and control assurance.
• Facilitate risk-based decision-making, clearly articulating business impacts and trade-offs.
• Act as the key interface between the divisions and group security & GRC functions.
• Support the business in preparing for and responding to security incidents.

This is a hybrid based role, with the requirement of working 2 days a week at either of our offices in Manchester, Stoke, Peterborough or Tunbridge Wells.

• Extensive experience in information security, risk management, or IT leadership roles, ideally with business-facing responsibilities.
• Strong knowledge of security risk management and governance frameworks, security architecture and secure delivery practices, regulatory and compliance requirements.
• Proven ability to translate security strategy into business-aligned outcomes.
• Experience embedding security into products, services, and operational processes.
• Demonstrated ability to influence senior business and technology stakeholders.
• Strong communication skills, translating technical risks into business impact and decision-making.
• Ability to build trusted relationships.