Senior Manager, Business Information Security

Job description

About Us:LSEG (London Stock Exchange Group) is more than a diversified global financial markets infrastructure and data business. We are dedicated, open-access partners with a dedication to excellence in delivering the services our customers expect from us. With extensive experience, deep knowledge and worldwide presence across financial markets, we enable businesses and economies around the world to fund innovation, manage risk and create jobs. It’s how we’ve contributed to supporting the financial stability and growth of communities and economies globally for more than 300 years. Through a comprehensive suite of trusted financial market infrastructure services – and our open-access model – we provide the flexibility, stability and trust that enable our customers to pursue their ambitions with confidence and clarity. LSEG is headquartered in the United Kingdom, with significant operations in 70 countries across EMEA, North America, Latin America and Asia Pacific. We employ 25,000 people globally, more than half located in Asia Pacific. LSEG’s ticker symbol is LSEG. Our People: People are at the heart of what we do and drive the success of our business. Our culture of connecting, creating opportunity and delivering excellence shape how we think, how we do things and how we help our people thrive. We embrace diversity and actively seek to attract individuals with unique backgrounds and perspectives. We break down barriers and encourage teamwork, enabling innovation and rapid development of solutions that make a difference. Our workplace generates an enriching and rewarding experience for our people and customers alike. Our vision is to build an inclusive culture in which everyone feels encouraged to fulfil their potential. We know that real personal growth cannot be achieved by simply climbing a career ladder – which is why we encourage and enable a wealth of avenues and interesting opportunities for everyone to broaden and deepen their skills and expertise. As a global organisation spanning 70 countries and one rooted in a culture of growth, opportunity, diversity and innovation, LSEG is a place where everyone can grow, develop and fulfil your potential with meaningful careers. Role Overview The Senior Manager, Business Information Security assesses, challenges and is responsible for cyber risk across an assigned Data & Analytics portfolio. The assignment may change in line with business priorities, organisational needs and the role holder’s experience. Working closely with leadership, product, engineering, technology and central Cyber teams across the assigned portfolio, the role supports the identification, assessment, remediation and ongoing management of cyber risk. The role helps ensure that security capabilities are deployed effectively, controls remain fit for purpose and material risks remain within LSEG’s risk appetite. This is a senior, business-facing security role requiring strong technical credibility, sound risk judgement and the ability to communicate effectively at both engineering and executive levels. The role builds trusted relationships across business, engineering and central Cyber, aligns collaborators around material risks and enables effective security outcomes. The successful candidate must translate complex technical security issues into clear business exposure, impact, treatment options and decisions. They must also understand relevant threat actors, motivations and techniques, and how credible attack paths could affect the assigned portfolio, its information assets, customers and broader business outcomes. Key Responsibilities Information Security and Cyber Risk Oversight Develop and maintain a clear, evidence-based and threat-informed cyber risk profile for the assigned portfolio. Be responsible for the security and risk governance of AI used across the assigned portfolio, ensuring business adoption is appropriately assessed, controlled and aligned with LSEG requirements. Identify material cyber risks, control weaknesses and remediation opportunities, ensuring treatment plans are owned, prioritised and tracked to completion. Assess inherent and residual risk, considering threat relevance, control effectiveness, business impact and risk appetite. Drive proportionate risk treatment by communicating exposure, options, recommendations and decision consequences, with acceptance considered only where other strategies are inappropriate. Provide accurate cyber risk reporting, key risk indicators and management information. Help business and technology teams understand their accountability for security risk management and remediation. Technical Security Review and Challenge Assess security controls across applications, infrastructure, cloud services, data platforms and third-party services. Evaluate the secure use of AI-enabled tools, including their effectiveness, limitations, data handling and impact on control design and security operations. Review security architecture, solution designs and material technology changes to identify security risks, control gaps and attack paths. Challenge vulnerability prioritisation, penetration testing findings, severity ratings, remediation plans and risk treatment decisions. Review privileged access, identity controls, service accounts, workload identities, secrets management, exceptions and compensating controls. Assess cyber implications of legacy technology, technical debt, obsolescence and major transformation initiatives. Provide practical, proportionate and risk-based recommendations that protect LSEG while enabling delivery. Threat-Informed Business Risk Management Maintain an informed understanding of relevant threat actors, motivations, capabilities and techniques. Assess how AI changes the threat landscape, including AI-enabled attack techniques, threats to AI systems and emerging risks relevant to the assigned portfolio. Work with Cyber Intelligence and Security Operations teams to understand threats relevant to the assigned portfolio. Assess how credible threat activity could exploit weaknesses or combined control gaps to create material attack paths. Translate technical threat scenarios into potential business consequences, including service disruption, data loss or compromise, customer impact, regulatory or contractual exposure, financial loss and reputational harm. Use threat information to influence risk prioritisation, control investment and remediation decisions. Help leadership distinguish between theoretical technical weaknesses and credible, material business risk. Executive Communication and Decision Support Translate complex cyber security topics into clear, concise and decision-focused communication for executive leadership. Explain technical issues without unnecessary detail while preserving the substance and severity of the risk. Clearly articulate affected services and outcomes, threats and attack paths, controls and weaknesses, inherent and residual risk, treatment options, recommendations and required decisions. Adapt communication for executive, risk, product, engineering, audit and regulatory audiences. Provide balanced advice that supports informed decisions rather than relying solely on compliance statements or technical severity ratings. Communicate uncertainty, assumptions and evidence limitations clearly. Relationship-Building and Engagement Build and maintain trusted, effective relationships with business leadership, product teams, engineering teams and central Cyber across the assigned portfolio. Become a credible and accessible security partner who is engaged early in business, product and technology decisions. Develop a detailed understanding of the assigned portfolio’s strategy, services, technology environment, delivery priorities and business objectives. Establish credibility with engineering teams through technical understanding, pragmatic advice and consistent follow-through. Work collaborativel