Business Information Security Officer (BISO)

As the Business Information Security Officer for Risk and Brokering (R&B) you will be a crucial asset to WTW’s cyber security efforts, ensuing robust cyber security practices are embedded across the business unit and are aligned with the organisation’s overall security strategy.

This role is to serve as the global trusted information security partner to the business and technology teams, supporting them to ensure security items are appropriately managed.

This role is part of the extended Information & Cyber Security Leadership Team and resides within Corporate IT, reporting to the Lead Business Information Security Officer.

The Role

Primary responsibly is the BISO for Risk and Brokering (R&B):

• Serve as a leader within the Information & Cyber Security Team, as the trusted advisor to R&B leadership, providing strategic cybersecurity insights and recommendations to ensure a cohesive approach to cyber risk management.
• Ensure cybersecurity practices and security by design are integrated into business unit initiatives, motivating business units to adopt efficient security controls throughout their lifecycle.
• Oversight of R&B’s response to Incident, integrating cyber incident response policies with business operations to improve agility and effectiveness in cyber incident management.
• Work with R&B leaders to advise on disaster recovery and business continuity planning for business and cyber security resiliency.
• Key stakeholder representing information security to support the business and technology teams delivery of the security change programme.
• Provide support to the business and technology teams to understand and address vulnerabilities within SLA, identified through penetration testing, vulnerability scanning and red team exercises
• Foster relationships with internal business units to enhance cyber security communication, including knowledge of threats, vulnerabilities, and mitigation strategies.
• Provide strategic insights to senior management on cyber incident response readiness and effectiveness.
• Collaborate with security leadership to enforce cyber security policies and practices, addressing operations and incident response.
• Provide expertise and knowledge to the business with responses to client questions.
• Enforce the strong security culture set by the CISO, ensuing uniformity across R&B leadership, business units and employees.
• Support in the Identification of technology and cyber security risks.
• Ensure the technology teams are updated with changes to information security policy & standards and support them in adherence to changes.
• Lead the information security updates at business and technology governance forums.

The Requirements

Technical skills:

• A comprehensive understanding of information security services (security operations and offensive security testing)
• Experience of strategic planning and oversight of cyber incident response and crisis management
• Strong understanding of cybersecurity standards and frameworks (e.g. ISO27001, NIST, CIS) and their application in strategic planning and policy development
• Ability to collaborate business leadership to operationalise strategic decisions, ensuring alignment with organizational resilience goals.
• Understanding of regulatory requirements and their impact on security.

Additionally, the following are desirable but not essential:

• Degree in a relevant Information Technology or Information Security area
• Information security specific qualifications are desirable (such as CISM, CISSP)
• Leadership specific training or qualifications (such as Strategic Leadership and Management)
• Expert understanding of technical information security.

Non-technical skills:

• Exceptional skills in managing and engaging stakeholders at both technical and non-technical levels to foster strong relationships.
• Highly developed influencing abilities and communication skills, capable of articulating complex security concepts to diverse audiences.
• Proven ability to lead and motivate teams, with the ability to inspire and drive strategic initiatives forward.
• Able to manage multiple conflicting priorities and tasks in a dynamic and high-pressure environment.
• Effective in leading change, with the agility to adjust strategies and approaches in response to evolving cybersecurity landscapes.
• Politically aware with outstanding influencing ability and the ability to work with senior management.
• Demonstrated ability to work collaboratively within and across teams, promoting an inclusive and innovative work environment.
• Outstanding problem-solving skills, committed to ensuring issues are resolved and enhancing the security framework continuously.
• Excellent strategic and operational business awareness, with insights into the key drivers, challenges, constraints, and opportunities.

At WTW, we believe difference makes us stronger. We want our workforce to reflect the different and varied markets we operate in and to build a culture of inclusivity that makes colleagues feel welcome, valued and empowered to bring their whole selves to work every day. We are an equal opportunity employer committed to fostering an inclusive work environment throughout our organisation. We embrace all types of diversity.

We’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidate.helpdesk@willistowerswatson.com