Information Security Manager

ABOUT THE ROLE

Reporting to the RELX CISO and VP, Cybersecurity GRC, the Information Security Manager provides oversight, coordination, and day-to-day management of security resources while also serving as a senior contributor to customer trust and engagement. The role is dual-faceted: internally, you will manage a team of security professionals supporting RELX/ELS/REPH business units, driving governance, risk, and operational security programs. Externally, you will shape and deliver Elsevier's customer engagement strategy, resolving security inquiries, coordinating customer-initiated audits, and ensuring customers have the confidence they need to adopt and rely on our products.

The ideal candidate embraces AI, builds strong cross-functional relationships, communicates effectively in high-stakes customer engagements, and has the technical expertise to assess and explain complex security risks clearly.

KEY RESPONSIBILITIES

People & Team Leadership (25%)

• Directly manage security resources aligned to RELX/ELS/ REPH/RETS, clarifying roles, responsibilities, and priorities.

• Recruit, on-board, coach, and develop team members; manage performance and career growth plans.

• Communicate vision, set standards for excellence, and motivate the team to high performance.

• Manage resource allocation, prioritization, and planning to meet business and security objectives.

Customer Trust & Engagement (25%)

• Respond to customer security inquiries using knowledge bases, generative AI tooling, and subject matter expertise.

• Lead customer-initiated audits by coordinating across GRC, security engineering, and product teams.

• Build product security narratives and complete RFPs and customer assessments with accuracy and clarity.

• Maintain and continuously improve Elsevier's public Trust Centre and related customer-facing resources.

• Liaise with Sales, Sales Operations, and Product to streamline the intake and resolution of customer trust requests.

Risk Management & Governance (25%)

• Utilize security domain expertise to assess risks associated with third-party service providers, implementation, and operational activities.

• Monitor, identify, and facilitate mitigation of information security risks across third-party service providers.

• Define and publish KPIs that measure the effectiveness of the team, processes, and controls.

• Promote a security culture across technology and business stakeholders.

Security Implementation & Operations (25%)

• Oversee day-to-day security operations: incident management, vulnerability management, change management, and compliance monitoring.

• Review change requests with a security lens; monitor KPIs to ensure controls continuously meet business needs.

• Maintain internally developed security solutions and ensure service continuity.

• Stay current on information security technologies and commercially reasonable practices.

QUALIFICATIONS

• Information Security: Strong understanding of security principles, frameworks (ISO 27001/2 including 27017/18, ISO 22301, ISO 42001), and regulatory requirements (SOX). Able to translate risk findings into clear, actionable guidance for technical and non-technical audiences.

• Customer Engagement: Proven background managing customer security inquiries, questionnaires, Trust Centre operations, client calls, customer audits, and security-related contract language.

• Communication Skills: Exceptional written, verbal, and presentation abilities; demonstrable ability to influence, collaborate, and build trust with both customers and internal stakeholders.

• People Management: 3+ years' direct people management experience; skilled at coaching, performance management, and developing high-performing teams.

• Analytical Thinking: Ability to assess complex security scenarios, interpret customer requirements, and provide tailored, well-reasoned responses.

• Project Management: Proven capability to manage multiple concurrent engagements and strategic initiatives, delivering on time with effective prioritization.

• Growth Mindset: Approaches challenges as learning opportunities; adapts to evolving industry trends and stakeholder expectations.

EXPERIENCE & EDUCATION

• 8+ years of IT experience, including 4+ years in information security.

• 3+ years of people management in a security or technology environment.

• Bachelor's degree in a related field preferred.

• CISSP, CISM, or equivalent certification preferred.

CORE COMPETENCIES