JOB PURPOSE
The Cyber Security Manager is responsible for establishing, operating and continually
strengthening the Group's cyber security programme across corporate, retail, pharmacy,
distribution, digital and cloud environments.
▪ Accountable for the Group’s cyber security posture across IT systems, infrastructure
and networks, protecting them against cyber-attacks, intrusions, malware and data
breaches.
▪ Develop the cyber security strategy and roadmap from an assessment of IT security
needs and business objectives.
▪ Provide executive management with a clear view of material cyber risks, emerging
threats, control effectiveness, significant incidents and remediation priorities.
▪ Maintain and improve cyber security incident response plans and playbooks
(including ransomware, phishing and AI-enabled fraud such as deepfake
impersonation), lead and coordinate the response to security incidents, preserve
evidence, coordinate regulatory notifications with Group Legal, and brief executive
management on root cause and remediation.
▪ Oversee vulnerability management, security risk assessments and the penetration
testing programme.
▪ Define and integrate standardised security controls into IT applications and
infrastructure, including store, point-of-sale, pharmacy and distribution environments,
and drive their continuous improvement.

Oversee threat intelligence, emerging-threat research, external attack surface
monitoring (including domain spoofing and brand impersonation) and security tool
evaluation, and provide cyber risk inputs to the consolidated IT risk register.
▪ Report cyber security risk monthly (dashboards and key risk indicators) to executive
management.
▪ Own the IT security budget, licensing, renewals, vendor relationships and cost
allocation across Group entities, driving cost-effective delivery of strategic objectives.
▪ Manage the Cyber Security Lead (penetration testing, vulnerability management
and security assessments) and the Information Security Lead (information security
operations and access management), and through them their respective teams: set
priorities, standards and performance measures, recruit, develop and performancemanage
staff, and ensure the teams have the skills and resources they need.
▪ Embed security requirements into IT projects and new solutions from design through
go-live, ensuring risk-based penetration testing is scoped and budgeted with the
Cyber Security Lead within project delivery.

 

JOB OBJECTIVES
▪ Develop and maintain the Group cyber security strategy and multi-year roadmap based
on business priorities, the technology landscape, cyber threats, regulatory requirements
and the current maturity of security capabilities.
▪ Maintain the NIST CSF-aligned cyber security programme and IT security policies,
approving policy deviations within delegated authority based on documented risk
acceptance.
▪ Lead and perform complex investigations, configuration reviews and troubleshooting
across security platforms.
▪ Act as escalation point for the outsourced SOC/MDR provider: direct containment,
separate authorised testing from genuine threats, close visibility gaps, and manage
provider performance against SLAs and detection coverage.
▪ Own identity and access governance, including joiner-mover-leaver processes,
access reviews, privileged and third-party access, and segregation of duties.
▪ Own data security controls, including data loss prevention, sensitivity labelling and
encryption of sensitive and special personal information.
▪ Lead the cyber security workstream of audits and maturity assessments through to
remediation closure, and own the annual PCI DSS compliance programme.
▪ Act as security approver on the Change Advisory Board, including least-privilege
review of firewall changes and delegation within the team, and provide security
architecture input to significant changes and projects.
▪ Maintain the security posture of Microsoft 365, Entra ID, Azure and critical SaaS
platforms, and define application and API security requirements for digital channels,
including secure development and testing before release.
▪ Provide security input to supplier and SaaS risk assessments and contractual security
clauses.
▪ Define the Group's cyber security requirements for enterprise AI technologies and AIenabled
solutions.
▪ Provide security oversight of risks associated with enterprise AI use, including
inappropriate information exposure, excessive permissions, unsanctioned tools, agent
access, prompt injection, data leakage and manipulation of AI-enabled processes.
▪ Assess material AI solutions from a cyber security perspective before implementation
and ensure security requirements are incorporated into solution design and
governance.
▪ Draw on recognised AI security and risk practices including the NIST AI Risk
Management Framework, OWASP guidance for LLM applications and ISO/IEC 42001
where appropriate.
▪ Define risk-based security requirements for material technology suppliers, SaaS
providers and third parties with access to Group information, systems or critical
services.
▪ Provide security assessment and challenge as part of supplier onboarding and
material technology procurement, including review of relevant security evidence
and identification of contractual security requirements.
▪ Monitor significant supplier-security exposures and ensure identified risks are assigned
and remediatedor formally accepted.
▪ Procurement, Legal and the accountable business owner retain responsibility for
commercial decisions and acceptance of residual business risk.
▪ Define and validate cyber recovery requirements, including immutable backups and
protected recovery credentials, and drive cyber incident and recovery simulations.
▪ Run security awareness training with Legal Compliance, covering AI-enabled social
engineering and targeted phishing simulations for high-risk users.