IT Security Officer (ITSO)

Job Title: IT Security Officer Department: IT & Ops Report into : Lead IT Strategy & Delivery Location: London/Birmingham (Hybrid) - 2 days in the office No Visa Sponsorship for this role Role Purpose: We are looking for an IT Security Officer to join our IT & Operations team on a fixed-term contract. This is a practical, first-line information security role focused on supporting the secure delivery of IT services, operational change, projects and supplier activity. You will help implement, operate, monitor and evidence IT security controls, working closely with IT colleagues, Risk & Compliance and the Information Security Officer to ensure security requirements are embedded effectively across day-to-day operations. This role will suit someone who combines technical security knowledge with strong coordination, documentation and stakeholder management skills. You will be comfortable tracking remediation actions, maintaining control evidence, supporting vulnerability and patching activity, and escalating risks clearly and promptly where required. Responsibility: Own the implementation, operation, monitoring and evidence of Information Security and IT security controls within IT & Operations. Define, implement and evidence practical IT security requirements for systems, services, suppliers, projects and operational change. Coordinate vulnerability management, patching follow-up, access control support, monitoring activity and remediation tracking across IT services and environments. Maintain the IT & Operations risk register, ensuring risks, actions, owners, dates, status updates and supporting evidence are captured, reviewed and escalated where required. Support IT and information security risk assessment, treatment planning, operational follow-through and remediation of control deficiencies, audit actions and project security gaps. Provide operational and technical security subject matter expertise for IT services, projects, procurement, suppliers, service changes and BAU processes. Work closely with the ISO, Risk & Compliance, IT Leadership and control owners by providing timely operational input, evidence and escalation while maintaining clear First Line ownership for delivery. Escalate significant information security risks, incidents, material vulnerabilities, overdue remediation, risk acceptances, policy violations and control failures in a timely manner. Provide secretariat support to the IT Security Committee, including agendas, papers, actions, decisions and follow-up tracking. Support role-appropriate security awareness, training, guidance and incident response activity across IT and relevant business stakeholders. What you will bring: Experience in information security, cyber security, IT risk, IT controls, technology governance or operational resilience environment. Strong understanding of cybersecurity and technical controls, including vulnerability management, patching, access control, network and endpoint security, monitoring, secure configuration and incident response. Experience maintaining risk registers, action trackers and evidence of control operation, remediation activity, vulnerability management, patching progress and security compliance. Ability to assess, classify, coordinate treatment of, track and evidence IT and cybersecurity risks using recognised frameworks and operational procedures. Confident working with IT teams, suppliers, Risk & Compliance, control owners and business stakeholders, with the ability to communicate security requirements clearly and pragmatically. Strong organisational skills, with the ability to manage competing priorities, follow through on agreed actions and escalate issues appropriately. A continuous improvement mindset, with an interest in strengthening security control effectiveness, resilience, evidence quality, awareness and operational efficiency. Knowledge of Group security standards, local policies, regulatory expectations, ISO 27001, DORA, ITIL, NIST or similar frameworks would be beneficial. Why join us?: You will play a visible First Line role in strengthening operational security, resilience and control effectiveness across IT & Operations. The role offers broad exposure to IT services, technology change, suppliers, projects, risk management, assurance and regulatory readiness, while working closely with the ISO and Second Line functions in a collaborative and practical environment. Why ERGO? ERGO UK Specialty is a well-established specialist insurer with a strong market reputation. We are focused on profitable, sustainable growth, operational excellence and delivering consistent value to clients and partners. Equal opportunities We are an equal opportunities employer and welcome applications from all suitably qualified candidates. We are committed to a fair, inclusive and accessible recruitment process. If you’re ready to take on this role, we’d love to hear from you.