Information Security Officer

About the role

Super is creating a new Information Security Officer position within its Cybersecurity team. The role focuses on governance and compliance, owning the company‑wide security policy framework and ensuring every team meets regulatory obligations.

Key responsibilities

• Own and maintain the information security policy framework, aligning it with business needs and standards such as ISO 27001 and GDPR.
• Update and drive the security compliance strategy, including operation of the GRC platform.
• Design and deliver security awareness and training programmes tailored to different teams.
• Drive compliance adoption across business units, validate steps, and manage escalations for gaps.
• Track and report on policy exceptions and remediation progress.
• Own the PII compliance plan, deprecate unencrypted PII and report to the Board and Risk Committee.
• Coordinate with external auditors, manage evidence collection, and support audits and certifications.
• Provide regular compliance reporting to leadership, the Board and the Risk Committee.

Required profile

• Proven experience in information security governance, risk and compliance (GRC) in a regulated, multi‑market environment.
• Deep, practical knowledge of ISO 27001, GDPR and related data‑protection standards.
• Experience owning security policy frameworks and running security awareness and training programmes.
• Hands‑on experience operating a GRC platform and driving compliance initiatives.

Required skills

• ISO 27001
• GDPR
• GRC platform