Information Security Manager

We are looking for an information security manager to own the organization's security program — governance, risk, and controls across identity, data, cloud, endpoints, and applications — translating regulatory and business requirements into a defensible security posture and reporting risk to leadership. This is a management role that leads security engineers and analysts, sets policy and standards, runs the risk-management lifecycle, and is accountable for the program's measurable outcomes rather than any single control.

The defining shift for this seat in 2026 is a dual mandate: security teams increasingly use AI to analyze large volumes of security data, prioritize alerts, and automate repetitive workflows, while simultaneously having to secure the organization's own AI systems and manage the new risks they create. Practitioners are now expected to direct, constrain, and verify AI-assisted work while keeping the judgment to catch an agent when it is wrong. New threat classes — prompt injection, model abuse, data leakage, and unsafe automation — now sit inside the manager's risk register alongside traditional ones.

The value this person brings is a coherent, measurable security program that reduces real risk and satisfies compliance — now extended to govern the organization's growing population of AI agents as first-class assets.

We are seeking a security leader who thinks in terms of risk and business impact, not just controls — someone who can set policy, run a risk-management program, lead a small security team, and explain trade-offs to executives in plain language. They stay current on how AI is reshaping both the defender's toolkit and the threat surface.

This profile partners across security engineering, IT / infrastructure, compliance / legal, and executive leadership. It suits someone open to a hybrid engagement, and to mobilization to the Middle East, Europe, or North America depending on the client. The person we want makes risk visible and manageable.

A strong candidate for this role has built or matured a security program — someone who has owned policy and standards, run a risk-assessment and treatment cycle, led security engineers/analysts, and reported posture to leadership and auditors. They bring the judgment to fold AI-specific risks and AI-assisted defense into an existing program without losing rigor.

In practice, the responsibilities break down as follows:

• Security governance & policy: Own security policy, standards, and control frameworks; align the program to regulatory and business requirements.
• Risk management: Run the risk lifecycle — identification, assessment, treatment, and acceptance — and maintain the risk register, now including AI-specific threats such as prompt injection, model abuse, and data leakage.
• Team leadership: Lead and develop security engineers and analysts; set priorities and standards for the function.
• Executive & compliance reporting: Report security posture and risk to leadership; support audits and regulatory obligations.
• AI-era defense & governance: Adopt AI to prioritize alerts and automate repetitive workflows while directing, constraining, and verifying that AI-assisted work — and governing the organization's own AI systems;.

We want to see a manager with genuine security depth who can also govern, communicate risk, and lead a team. They should be fluent in frameworks and controls, and thinking seriously about securing AI systems and using AI safely in defense. The strongest candidates treat AI agents as assets to be governed, not just tools to be used.

Core security management

• Security frameworks and controls (NIST, ISO 27001, MITRE ATT&CK); risk management and GRC.
• Identity, data protection, cloud security (AWS, Azure, GCP or equivalent), and application security awareness.
• Policy, audit, and compliance alignment.

Program performance (KPIs from research)

• Steers risk-reduction, control coverage/maturity, audit and compliance outcomes, and incident trend — while extending the register to AI-specific threats.

Modern Agentic AI / AIOps (niche areas we are seeking — depth explored at interview)

• Directing, constraining, and verifying AI-assisted security work — retaining the judgment to catch a wrong agent.
• Securing the organization's own AI — defending against prompt injection, model abuse, data leakage, and unsafe automation.

This role is delivered through Solutions Chapter Group's Human Resources chapter (Chapter 12) as a Recruitment Process Outsourcing (RPO) engagement, under our Technical Recruitment stream. Rather than a "post-and-pray" marketplace approach, we use a Curated Professional Recruitment model: candidate profiles are pre-vetted in our internal database, and when a required profile isn't already available, our dedicated Scout network conducts global headhunting to secure it. We screen and match candidates against each client's specific requirements, and placements may be remote or an on-site deployment with mobilization to the Middle East, Europe, or the United States.

From a recruitment-fit perspective, we screen for:

• Risk-based, business-aware security thinking.
• Clear risk communication to executives and auditors.
• Program and team leadership.
• Awareness of AI-era threats and AI-assisted defense.
• Openness to the engagement model (remote or mobilized on-site) and readiness for cross-region deployment.

Areas to explore at interview *(topics only)*

• Maturing a security program
• Running a risk assessment and treatment cycle