Senior Manager, Business Information Security

About Us:

LSEG (London Stock Exchange Group) is more than a diversified global financial markets infrastructure and data business. We are dedicated, open-access partners with a dedication to excellence in delivering the services our customers expect from us. With extensive experience, deep knowledge and worldwide presence across financial markets, we enable businesses and economies around the world to fund innovation, manage risk and create jobs. It’s how we’ve contributed to supporting the financial stability and growth of communities and economies globally for more than 300 years. Through a comprehensive suite of trusted financial market infrastructure services – and our open-access model – we provide the flexibility, stability and trust that enable our customers to pursue their ambitions with confidence and clarity.

LSEG is headquartered in the United Kingdom, with significant operations in 70 countries across EMEA, North America, Latin America and Asia Pacific. We employ 25,000 people globally, more than half located in Asia Pacific. LSEG’s ticker symbol is LSEG.

Our People:

People are at the heart of what we do and drive the success of our business. Our culture of connecting, creating opportunity and delivering excellence shape how we think, how we do things and how we help our people thrive. We embrace diversity and actively seek to attract individuals with unique backgrounds and perspectives.  We break down barriers and encourage teamwork, enabling innovation and rapid development of solutions that make a difference. Our workplace generates an enriching and rewarding experience for our people and customers alike. Our vision is to build an inclusive culture in which everyone feels encouraged to fulfil their potential.

We know that real personal growth cannot be achieved by simply climbing a career ladder – which is why we encourage and enable a wealth of avenues and interesting opportunities for everyone to broaden and deepen their skills and expertise. As a global organisation spanning 70 countries and one rooted in a culture of growth, opportunity, diversity and innovation, LSEG is a place where everyone can grow, develop and fulfil your potential with meaningful careers.

Role Overview 

The Senior Manager, Business Information Security assesses, challenges and is responsible for cyber risk across an assigned Data & Analytics portfolio. The assignment may change in line with business priorities, organisational needs and the role holder’s experience. 

Working closely with leadership, product, engineering, technology and central Cyber teams across the assigned portfolio, the role supports the identification, assessment, remediation and ongoing management of cyber risk. The role helps ensure that security capabilities are deployed effectively, controls remain fit for purpose and material risks remain within LSEG’s risk appetite. 

This is a senior, business-facing security role requiring strong technical credibility, sound risk judgement and the ability to communicate effectively at both engineering and executive levels. 

The role builds trusted relationships across business, engineering and central Cyber, aligns collaborators around material risks and enables effective security outcomes. 

The successful candidate must translate complex technical security issues into clear business exposure, impact, treatment options and decisions. They must also understand relevant threat actors, motivations and techniques, and how credible attack paths could affect the assigned portfolio, its information assets, customers and broader business outcomes. 

Key Responsibilities 

Information Security and Cyber Risk Oversight 

• Develop and maintain a clear, evidence-based and threat-informed cyber risk profile for the assigned portfolio. 

• Be responsible for the security and risk governance of AI used across the assigned portfolio, ensuring business adoption is appropriately assessed, controlled and aligned with LSEG requirements. 

• Identify material cyber risks, control weaknesses and remediation opportunities, ensuring treatment plans are owned, prioritised and tracked to completion. 

• Assess inherent and residual risk, considering threat relevance, control effectiveness, business impact and risk appetite. 

• Drive proportionate risk treatment by communicating exposure, options, recommendations and decision consequences, with acceptance considered only where other strategies are inappropriate. 

• Provide accurate cyber risk reporting, key risk indicators and management information. 

• Help business and technology teams understand their accountability for security risk management and remediation. 

Technical Security Review and Challenge 

• Assess security controls across applications, infrastructure, cloud services, data platforms and third-party services. 

• Evaluate the secure use of AI-enabled tools, including their effectiveness, limitations, data handling and impact on control design and security operations. 

• Review security architecture, solution designs and material technology changes to identify security risks, control gaps and attack paths. 

• Challenge vulnerability prioritisation, penetration testing findings, severity ratings, remediation plans and risk treatment decisions. 

• Review privileged access, identity controls, service accounts, workload identities, secrets management, exceptions and compensating controls. 

• Assess cyber implications of legacy technology, technical debt, obsolescence and major transformation initiatives. 

• Provide practical, proportionate and risk-based recommendations that protect LSEG while enabling delivery. 

Threat-Informed Business Risk Management 

• Maintain an informed understanding of relevant threat actors, motivations, capabilities and techniques. 

• Assess how AI changes the threat landscape, including AI-enabled attack techniques, threats to AI systems and emerging risks relevant to the assigned portfolio. 

• Work with Cyber Intelligence and Security Operations teams to understand threats relevant to the assigned portfolio. 

• Assess how credible threat activity could exploit weaknesses or combined control gaps to create material attack paths. 

• Translate technical threat scenarios into potential business consequences, including service disruption, data loss or compromise, customer impact, regulatory or contractual exposure, financial loss and reputational harm. 

• Use threat information to influence risk prioritisation, control investment and remediation decisions. 

• Help leadership distinguish between theoretical technical weaknesses and credible, material business risk. 

Executive Communication and Decision Support 

• Translate complex cyber security topics into clear, concise and decision-focused communication for executive leadership. 

• Explain technical issues without unnecessary detail while preserving the substance and severity of the risk. 

• Clearly articulate affected services and outcomes, threats and attack paths, controls and weaknesses, inherent and residual risk, treatment options, recommendations and required decisions. 

• Adapt communication for executive, risk, product, engineering, audit and regulatory audiences. 

• Provide balanced advice that supports informed decisions rather than relying solely on compliance statements or technical severity ratings. 

• Communicate uncertainty, assumptions and evidence limitations clearly. 

Relationship-Building and Engagement 

• Build and maintain trusted, effective relationships with business leadership, product teams, engineering teams and central Cyber across the assigned portfolio. 

• Become a credible and accessible security partner who is engaged early in business, product and technology decisions. 

• Develop a detailed understanding of the assigned portfolio’s strategy, services, technology environment, delivery priorities and business objectives. 

• Establish credibility with engineering teams through technical understanding, pragmatic advice and consistent follow-through. 

• Work collaboratively with engineers and architects to translate security requirements into practical, sustainable technical outcomes. 

• Maintain a partnership-first relationship with central Cyber, aligning the assigned portfolio with Group strategy, policies, standards and capabilities. 

• Represent the assigned portfolio’s business and engineering context clearly to central Cyber without weakening Group security requirements. 

• Align business, engineering and central Cyber partners on material risks, accountabilities, treatment plans and decisions. 

• Influence outcomes across organisational boundaries without relying solely on formal authority. 

• Challenge decisions and raise material risk with independence and sound judgement while preserving productive relationships. 

Candidate Profile 

An experienced and qualified information or cyber security professional, able to operate credibly in a large, sophisticated technology environment. A strong technical background and/or previous consulting experience advising senior team members on complex cyber security or technology risk matters is highly beneficial. 

• Strong security knowledge and risk judgement, with the ability to understand complex technical topics, challenge assumptions and assess credible threats, attack paths, control weaknesses and business impact. 

• Excellent written and verbal communication, including the ability to translate complex technical security matters into clear, concise and decision-focused messages for non-technical and senior participants. 

• Proven ability to build trusted relationships across business leadership, product, engineering and central Cyber, influence across organisational boundaries and maintain productive relationships while providing constructive challenge. 

• Experience in relevant areas such as cloud, security engineering or operations, architecture, vulnerability management, identity and privileged access, application or data security, resilience and third-party security. 

• Able to form an independent, evidence-based risk view and communicate exposure, treatment options, recommendations and required decisions. 

Desirable Certifications

• CISSP
• CISM
• Equivalent industry-recognised technical or security risk qualifications, such as OSCP or OSCE, are beneficial.
• Certifications complement, but do not replace, technical credibility, practical risk judgement and executive communication capability.

Knowledge

• NIST Cybersecurity Framework
• ISO 27001 and ISO 27002
• CIS Controls
• Relevant regulations such as DORA
• Security architecture principles
• Cyber threat and attack-path analysis
• Cloud security and cyber resilience
• Cyber risk management and control assurance
• Regulatory expectations in a highly regulated financial services environment
• Knowledge of, and a strong interest in, AI technologies and their security, risk and business implications will be highly beneficial.

Career Stage:

Manager

London Stock Exchange Group (LSEG) Information:

Join us and be part of a team that values innovation, quality, and continuous improvement. If you're ready to take your career to the next level and make a significant impact, we'd love to hear from you.

LSEG is a leading global financial markets infrastructure and data provider. Our purpose is driving financial stability, empowering economies and enabling customers to create sustainable growth.

Our purpose is the foundation on which our culture is built. Our values of Integrity, Partnership, Excellence and Change underpin our purpose and set the standard for everything we do, every day. They go to the heart of who we are and guide our decision making and everyday actions.

Working with us means that you will be part of a dynamic organisation of 25,000 people across 65 countries. However, we will value your individuality and enable you to bring your true self to work so you can help enrich our diverse workforce.

We are proud to be an equal opportunities employer. This means that we do not discriminate on the basis of anyone’s race, religion, colour, national origin, gender, sexual orientation, gender identity, gender expression, age, marital status, veteran status, pregnancy or disability, or any other basis protected under applicable law. Conforming with applicable law, we can reasonably accommodate applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs.

You will be part of a collaborative and creative culture where we encourage new ideas. We are committed to sustainability across our global business and we are proud to partner with our customers to help them meet their sustainability objectives. Our charity, the LSEG Foundation provides charitable grants to community groups that help people access economic opportunities and build a secure future with financial independence. Colleagues can get involved through fundraising and volunteering.

LSEG offers a range of tailored benefits and support, including healthcare, retirement planning, paid volunteering days and wellbeing initiatives.

Please take a moment to read this privacy notice carefully, as it describes what personal information London Stock Exchange Group (LSEG) (we) may hold about you, what it’s used for, and how it’s obtained, your rights and how to contact us as a data subject.

If you are submitting as a Recruitment Agency Partner, it is essential and your responsibility to ensure that candidates applying to LSEG are aware of this privacy notice.