Business Program Manager

Role overview

Information security governance and policy

• Define, maintain and implement information and operational security policies, standards and procedures aligned with UK Government policy, Microsoft requirements and contractual obligations.
• Advise on information security governance for UK national security programmes and provide challenge when compliance obligations may be at risk.
• Translate government and customer security requirements into scalable controls and support audits, inspections, assurance reviews and customer accreditation.
• Monitor changes in UK Government security policy, regulation and the national security threat landscape.

Programme security governance and assurance

• Provide security leadership across the programme lifecycle, from early engagement and tenders through delivery and operation.
• Work with programme management and engineering teams to embed security in programme design and delivery.
• Review Security Aspects Letters, Security Grading Guides, contractual security schedules and security flow-down requirements.
• Support Security Management Plans, assurance documentation and customer or programme Security Working Groups.
• Ensure information security risks are identified, documented, reviewed and escalated through appropriate governance.

Contract security

• Engage sales, account and bid teams early to identify security requirements.
• Review relevant DEFCON, Defence Standard and customer-specific security requirements.
• Advise on security obligations in Statements of Work and identify risks in proposed commitments or solutions.
• Support customer discussions to clarify or negotiate security requirements and ensure agreed requirements transition into delivery.

Information security risk management

• Support security risk assessments across UK national security programmes.
• Review programme risk registers and evaluate proposed mitigations.
• Escalate significant security risks to appropriate risk owners or governance bodies.

Role purpose and stakeholder profile

• The role is an information security adviser to programme teams, engineering, sales, legal, security stakeholders and leadership.
• It translates complex regulatory and contractual requirements into practical controls that support secure and compliant delivery.
• The posting title says Business Program Manager, but the detailed role description repeatedly identifies the opening as Information Security Manager.