Mercury Engineering, Ihre Vision, unsere Verpflichtung.

Mercury is the European leader in construction solutions.

 We build and manage complex engineering & construction projects for the world’s leading corporations. Our solutions help deliver technologies and life changing advancements that connect people, communities, and businesses, giving them the power to achieve incredible things. Our people have the courage to be innovative. Their determination and sharp focus enable us to deliver with certainty, time and time again.

We deliver our clients’ visions through leading edge construction solutions across multiple sectors, including Enterprise Data Centres, Advanced Technology & Life Sciences, Hyperscale Data Centres, Fire Protection.

At Mercury, it is our duty to encourage and back our people to realise their vision of themselves. We place them at the heart of what we do, providing challenging opportunities to develop within a great team in a supportive environment that allows them to reach their full potential.

 

 

Scope of the Role:

We are seeking a Head of Information Security to own and lead the information security function for Mercury Engineering. Reporting to the Head of IT, the successful candidate will set the direction of our security, compliance and third-party risk agenda, and translate it into a funded, measurable programme of work.

This is a strategic leadership role rather than a hands-on operations role. The Head of Information Security is accountable for the overall security posture of the organisation: the design and maintenance of the information security management system, the way security risk is identified, quantified and reported to senior leadership, the assurance we provide to clients, and the management of security risk introduced through our supply chain and joint venture partners. Day-to-day monitoring and response activity is delivered through internal specialists and managed security service providers, whom this role directs and holds to account.

The role carries influence well beyond the IT function. The successful candidate will be expected to engage credibly with executive leadership, client security teams, auditors, insurers and Tier 1 suppliers, and to represent Mercury’s security position in commercial and contractual discussions.

 

 

Key Responsibilities of the Role:

Security Strategy and Governance

• Security strategy: Define, own and maintain a multi-year information security strategy and roadmap aligned to Mercury’s business plan, client commitments and risk appetite. Secure senior leadership endorsement and review the strategy at least annually.
• Governance framework: Own the information security policy framework, standards and supporting procedures. Ensure they remain current, proportionate, understood by the business, and consistent with the requirements of the sectors we build in.
• Executive and board reporting: Produce and present clear reporting on security posture, risk, incidents and programme delivery to the Head of IT, executive leadership and relevant committees. Translate technical exposure into commercial and operational terms.
• Assurance and control effectiveness: Establish a control assurance approach that evidences whether controls are operating as designed, using a combination of internal testing, independent assessment and audit.
• Metrics: Define and report a meaningful set of security and compliance metrics, and use them to direct investment and prioritisation rather than simply to describe activity.

Information Security Risk Management

• Risk framework: Own the information security risk management methodology, risk register and treatment planning. Ensure security risk is captured, owned by the business and escalated consistently with Mercury’s wider enterprise risk process.
• Risk assessment: Direct regular risk assessments across the corporate estate, project environments and site-based technology. Ensure findings translate into funded, tracked remediation with clear ownership.
• Risk acceptance: Advise business owners on residual risk, articulate options and consequences clearly, and administer a defensible exception and risk acceptance process.
• Emerging risk: Maintain awareness of the threat landscape relevant to construction and to our clients’ sectors, and of emerging risk areas such as artificial intelligence adoption, operational technology on site, and cloud concentration.

Compliance and Certification

• ISO/IEC 27001:2022: Act as the senior owner of the information security management system. Maintain and continually improve the ISMS, direct internal audit and management review, own the corrective action process, and lead preparation for and engagement with the certification body across surveillance and recertification audits.
• Scope management: Manage the certified scope of the ISMS, including changes arising from new business, new locations, acquisitions and changes to service delivery models.
• Regulatory compliance: Maintain oversight of information security obligations arising from applicable law and regulation, including data protection legislation and network and information security requirements, working with Legal, Data Protection and Compliance colleagues to ensure obligations are met and evidenced.
• Contractual compliance: Ensure security commitments given to clients are understood, achievable and demonstrably met, and that gaps are identified before they become findings.
• Frameworks and benchmarking: Assess Mercury’s posture against recognised frameworks and client-mandated standards, and use the results to prioritise improvement.

Third-Party and Supply Chain Risk

• Programme ownership: Design, implement and own a third-party information security risk management programme covering suppliers, subcontractors, joint venture partners, agency labour providers and technology vendors.
• Due diligence: Establish risk-based due diligence and tiering for new and existing third parties, and lead assessment of Tier 1 relationships personally.
• Contractual controls: Work with Procurement, Legal and Commercial to embed appropriate security, confidentiality, incident notification, audit and data handling obligations in contracts, pre-qualification and tender documentation.
• Ongoing monitoring: Maintain continuous oversight of third-party security performance, including periodic reassessment, remediation tracking, and escalation where a supplier’s posture presents unacceptable risk to Mercury or our clients.
• Site and project supply chain: Address the specific characteristics of construction supply chains, including short-notice mobilisation, transient workforces, shared site environments and client-imposed security requirements on subcontractors.
• Fourth-party and concentration risk: Understand and report on material dependencies held by our key suppliers, and on concentration risk within critical services.

Security Operations Oversight

• Service provider governance: Own the relationship with managed security service providers delivering managed detection and response, endpoint protection and vulnerability management as a service. Set expectations, govern performance against service levels, review outputs critically and drive continual improvement.
• Operational direction: Direct the internal security team in the delivery of monitoring, vulnerability management, identity and access governance, and security tooling administration, ensuring priorities reflect assessed risk.
• Security architecture: Provide security input and approval into technology change, infrastructure design, cloud adoption and project delivery, working with infrastructure and applications colleagues to embed security by design.
• Vulnerability and patch assurance: Set standards for vulnerability identification and remediation across the estate, and hold technical owners to account for closure within agreed timeframes.

Incident Response and Resilience

• Incident management: Own the security incident response framework. Lead the response to significant security incidents, including containment decisions, internal and external communications, regulatory and client notification, investigation and post-incident review.
• Preparedness: Run regular exercises and simulations with technical teams and senior leadership so that response capability is tested rather than assumed.
• Resilience: Contribute security requirements to business continuity and disaster recovery planning, and assure the recoverability of critical systems and data.
• External engagement: Maintain appropriate relationships with law enforcement, national cyber authorities, insurers and specialist response providers, and coordinate with them when required.

Security Culture and Awareness

• Awareness programme: Own the company-wide security awareness and training programme, including phishing simulation, role-based training and onboarding, and measure its effect on behaviour rather than completion rates alone.
• Senior engagement: Convene security workshops and briefings with senior stakeholders and project leadership to build understanding of risk and ownership of controls.
• Site and project engagement: Extend security awareness to project and site-based teams, recognising that they operate in client environments with their own requirements and constraints.

Leadership, People and Budget

• Team leadership: Lead, develop and structure the information security team. Set objectives, manage performance, identify capability gaps and build a succession and development plan.
• Resourcing: Determine the appropriate balance between internal capability and outsourced service, and make the case for resourcing where required.
• Budget ownership: Own the information security budget, including multi-year forecasting, business case development, procurement and management of spend against plan.
• Commercial engagement: Support bids, tenders and client onboarding by providing security content, completing client security assessments, and participating in client audits and due diligence.

 

 

 

Essential Criteria for the Role:

• Experience: Minimum of 10 years’ experience in information security, of which at least 4 years in a leadership role with accountability for strategy, budget and team.
• Governance and compliance: Demonstrable ownership of an ISO/IEC 27001 certified management system, including audit preparation, management review, corrective action and scope management. Working knowledge of the 2022 revision.
• Risk management: Proven experience establishing and running an information security risk management framework in a distributed organisation, and reporting risk to executive audiences.
• Third-party risk: Practical experience designing and operating a third-party or supply chain security risk programme, including due diligence, contractual controls and ongoing monitoring.
• Technical grounding: Sound understanding of security architecture, identity and access management, cloud and Microsoft 365 security, network security, endpoint protection, detection and response, and vulnerability management — sufficient to direct specialists and challenge suppliers with authority.
• Incident leadership: Experience leading the response to significant security incidents, including decision making under pressure and communication with senior stakeholders.
• Supplier management: Experience managing managed security service providers and security vendors, including commercial negotiation and performance management.
• Regulatory awareness: Working knowledge of data protection legislation and of the direction of network and information security regulation as it applies to organisations of Mercury’s size and sector.
• Communication: Ability to present complex risk clearly and without exaggeration to non-technical audiences, and to write to a standard suitable for executive and client consumption.
• Education: Primary degree in information technology, information security, engineering or a related discipline, or equivalent professional experience.

 

Desirable Criteria:

•  Certification: CISM, CISSP, CRISC, ISO/IEC 27001 Lead Auditor or Lead Implementer, or equivalent.
• Sector experience: Experience in construction, engineering, or another project-based industry, or in serving clients in data centre, semiconductor or pharmaceutical sectors.
• Client-facing assurance: Experience representing an organisation’s security posture to major clients, including participation in client-led audits.
• Additional frameworks: Familiarity with NIS2, CIS Controls, NIST Cybersecurity Framework, SOC 2 or client-specific security standards.
• Multi-jurisdiction: Experience operating a security function across multiple European jurisdictions.
• Postgraduate study: Master’s degree in information security, risk management or a related field.

 

 

Mercury is an equal opportunities employer.

Jetzt Bewerben