Hometrack’s market-leading property data sets, valuation models, and risk insights are delivered via our suite of B2B SaaS applications for mortgage lenders, brokers, and more. We’ve led the market for over twenty years! Our services are mission-critical to the UK’s top banks, automating their mortgage offers. They’re used daily by home builders, mortgage brokers, local councils, and more to make informed property purchasing decisions. We have an exciting strategy to serve an even wider section of the market, with innovative products and services. As the Information Security Manager, you will lead Hometrack’s information security framework, ensuring our data, technology, and operational practices meet the rigorous standards expected by our banking and mortgage lending partners. You will be accountable for the ownership and maintenance of our ISO 27001 and Cyber Essentials certifications, driving continuous improvement in our overall security posture. This is a visible, high-impact role requiring both strategic ownership and hands-on governance to ensure security acts as a trusted business enabler across the organisation. Key Responsibilities 1. Governance, Compliance & Certifications Certification Ownership: Take accountability for the maintenance, auditing, and continuous improvement of Hometrack’s ISO 27001 Certified Information Security Management System (ISMS) and Cyber Essentials / Cyber Essentials Plus certifications, working in close collaboration with our Risk and Compliance officer. Audit & Risk Management: Plan and oversee internal security audits, external surveillance audits, and maintain the corporate Risk Register, prioritising and tracking remediation activities. Policy Management: Author, update, and enforce information security policies, standards, and procedures in line with industry best practices and regulatory shifts. 2. Financial Services & Regulatory Alignment Client & Regulatory Assurance: Support the Risk and Compliance officer with financial client security assessments, due diligence questionnaires, and third-party risk audits. Banking & Lending Compliance: Maintain a strong working knowledge of regulatory expectations affecting UK/EU banking and mortgage markets (e.g., FCA guidelines, PRA operational resilience frameworks, DORA, and GDPR) to ensure Hometrack’s solutions remain compliant. Third-Party Risk Management: Evaluate and monitor the security posture of Hometrack’s vendors and technology suppliers. 3. Strategy & Continuous Improvement Security Strategy Roadmap: Act as a key contributor, helping to prioritise, and implement strategic security initiatives to continuously mature Hometrack’s security posture. Security Awareness & Culture: Alongside the compliance and security owners deliver engaging security awareness training, phishing simulations, and guidance across all departments to foster a security-first culture. Incident Response & Resilience: Maintain, test, and continuously improve the Incident Response, Business Continuity, and Disaster Recovery plans. 4. Technical Collaboration & Support Collaborate closely with technical teams to embed "security by design" into software development and cloud architecture. Manage vulnerability management frameworks, penetration testing cycles, and threat modeling exercises, ensuring timely remediation of findings. Cross-Functional Collaboration: Exceptional ability to forge and sustain relationships across organisational boundaries, working alongside diverse teams to influence and prioritise technical backlogs effectively. Financial Oversight: Direct accountability for departmental budgets, ensuring operational cost efficiency and value-driven resource allocation. Experience & Knowledge Information Security Leadership: Proven experience operating as an Information Security Manager or Senior Security Officer within a technology, FinTech, or PropTech environment. Financial Services Context: Direct experience working within, or closely servicing, the Financial Services sector—specifically banking, mortgage lending, or credit processing. Framework Mastery: Demonstrable experience owning and maintaining an ISO 27001 ISMS and Cyber Essentials / Cyber Essentials Plus from end to end. Regulatory Awareness: Solid understanding of financial regulatory standards, third-party risk requirements, and data protection laws (GDPR/DPA 2018). Technical Credibility: Broad understanding of cloud platforms (AWS/Azure), secure software development lifecycles (DevSecOps), network security, and identity/access management (IAM). Stakeholder Management: Exceptional communication skills with the ability to translate technical security concepts into business risk discussions for senior stakeholders and external enterprise clients. Qualifications & Certifications (Desirable) Certified Information Security Manager (CISM) Certified Information Systems Security Professional (CISSP) Certified in Risk and Information Systems Control (CRISC) ISO 27001 Lead Implementer or Lead Auditor