Group Cyber Security Manager

Introduction

This is an opportunity to lead the cyber and information security across a complex, multi-brand Group and shape how the organisation protects its customers, people, information and operations against an increasingly sophisticated threat landscape. Reporting to the Executive for Cyber Security and Governance, the Cyber Security Manager establishes and operates the Group's cyber security programme, translates business priorities and risk appetite into security priorities, and provides executive management with a clear, evidence-based view of material cyber risk, control effectiveness and resilience. The role combines leadership with technical depth. The successful candidate will set the direction and standards, lead specialist teams and security partners, challenge technology and business owners on material risks, and remain sufficiently close to the technology to direct complex investigations, validate controls and lead the response to significant cyber incidents. Duties & Responsibilities

JOB PURPOSE The Cyber Security Manager is responsible for establishing, operating and continually strengthening the Group's cyber security programme across corporate, retail, pharmacy, distribution, digital and cloud environments. Accountable for the Group’s cyber security posture across IT systems, infrastructure and networks, protecting them against cyber-attacks, intrusions, malware and data breaches. Develop the cyber security strategy and roadmap from an assessment of IT security needs and business objectives. Provide executive management with a clear view of material cyber risks, emerging threats, control effectiveness, significant incidents and remediation priorities. Maintain and improve cyber security incident response plans and playbooks (including ransomware, phishing and AI-enabled fraud such as deepfake impersonation), lead and coordinate the response to security incidents, preserve evidence, coordinate regulatory notifications with Group Legal, and brief executive management on root cause and remediation. Oversee vulnerability management, security risk assessments and the penetration testing programme. Define and integrate standardised security controls into IT applications and infrastructure, including store, point-of-sale, pharmacy and distribution environments, and drive their continuous improvement. Oversee threat intelligence, emerging-threat research, external attack surface monitoring (including domain spoofing and brand impersonation) and security tool evaluation, and provide cyber risk inputs to the consolidated IT risk register. Report cyber security risk monthly (dashboards and key risk indicators) to executive management. Own the IT security budget, licensing, renewals, vendor relationships and cost allocation across Group entities, driving cost-effective delivery of strategic objectives. Manage the Cyber Security Lead (penetration testing, vulnerability management and security assessments) and the Information Security Lead (information security operations and access management), and through them their respective teams: set priorities, standards and performance measures, recruit, develop and performancemanage staff, and ensure the teams have the skills and resources they need. Embed security requirements into IT projects and new solutions from design through go-live, ensuring risk-based penetration testing is scoped and budgeted with the Cyber Security Lead within project delivery.

JOB OBJECTIVES Develop and maintain the Group cyber security strategy and multi-year roadmap based on business priorities, the technology landscape, cyber threats, regulatory requirements and the current maturity of security capabilities. Maintain the NIST CSF-aligned cyber security programme and IT security policies, approving policy deviations within delegated authority based on documented risk acceptance. Lead and perform complex investigations, configuration reviews and troubleshooting across security platforms. Act as escalation point for the outsourced SOC/MDR provider: direct containment, separate authorised testing from genuine threats, close visibility gaps, and manage provider performance against SLAs and detection coverage. Own identity and access governance, including joiner-mover-leaver processes, access reviews, privileged and third-party access, and segregation of duties. Own data security controls, including data loss prevention, sensitivity labelling and encryption of sensitive and special personal information. Lead the cyber security workstream of audits and maturity assessments through to remediation closure, and own the annual PCI DSS compliance programme. Act as security approver on the Change Advisory Board, including least-privilege review of firewall changes and delegation within the team, and provide security architecture input to significant changes and projects. Maintain the security posture of Microsoft 365, Entra ID, Azure and critical SaaS platforms, and define application and API security requirements for digital channels, including secure development and testing before release. Provide security input to supplier and SaaS risk assessments and contractual security clauses. Define the Group's cyber security requirements for enterprise AI technologies and AIenabled solutions. Provide security oversight of risks associated with enterprise AI use, including inappropriate information exposure, excessive permissions, unsanctioned tools, agent access, prompt injection, data leakage and manipulation of AI-enabled processes. Assess material AI solutions from a cyber security perspective before implementation and ensure security requirements are incorporated into solution design and governance. Draw on recognised AI security and risk practices including the NIST AI Risk Management Framework, OWASP guidance for LLM applications and ISO/IEC 42001 where appropriate. Define risk-based security requirements for material technology suppliers, SaaS providers and third parties with access to Group information, systems or critical services. Provide security assessment and challenge as part of supplier onboarding and material technology procurement, including review of relevant security evidence and identification of contractual security requirements. Monitor significant supplier-security exposures and ensure identified risks are assigned and remediatedor formally accepted. Procurement, Legal and the accountable business owner retain responsibility for commercial decisions and acceptance of residual business risk. Define and validate cyber recovery requirements, including immutable backups and protected recovery credentials, and drive cyber incident and recovery simulations. Run security awareness training with Legal Compliance, covering AI-enabled social engineering and targeted phishing simulations for high-risk users.

Desired Experience & Qualification

QUALIFICATIONS Degree or Diploma in Information Technology / Systems Engineering / Computer Science or a relevant equivalent qualification. CISSP or CISM certification (or equivalent). A relevant hands-on technical security certification, or a cloud security certification such as CCSP, is an advantage

JOB-RELATED KNOWLEDGE & EXPERIENCE At least 8 years (Diploma) or 7 years (Degree) of experience in the IT environment, including at least 5 years of hands-on cyber or information security experience and 3 years or more managing technical security teams and team leads. Strong knowledge of the design, configuration, maintenance and support of IT cyber security systems and architecture within an enterprise environment. Experience running vulnerability management programmes and coordinating patch remediation with technology owners, including remediation SLAs. Hands-on proficiency in several of: EDR/XDR, SIEM/MDR operations, privileged access management, identity governance, Active Directory and Entra ID, Microsoft 365 security, zero trust network access, email security, next-generation fi