How to Become an Information Security Manager in the UK
Information security managers protect an organisation's data and systems by setting security policy and making sure it is followed. You assess risks, run or oversee security controls, manage incidents, prepare for audits against standards such as ISO 27001, train staff and tell senior leaders how secure the business really is.
This is not an entry-level job. Most people reach it after five or more years in cyber security, IT, risk or audit, usually with recognised security certifications.
Quick facts
- Starting salary
- £55,000 - £70,000
- Mid-career salary
- £75,000 - £95,000
- Senior salary
- £100,000 - £150,000+
- Work environment
- Office or hybrid
- Time to entry
- 5+ years security background
- Degree required
- Preferred - CISSP / CISM widely required
- Category
- Technology
Compare pay across careers in the UK salaries by career report. Also in: High-paying careers, Stable careers.
What a Information Security Manager does
Own information security strategy across an organisation - policy, controls, audit and incident response.
How to become an information security manager in the UK
The usual path runs through roles such as IT support, security analyst, security engineer or governance, risk and compliance (GRC) analyst before moving into management. Employers often ask for CISSP from ISC2 or CISM from ISACA, and the BCS Foundation Certificate in Information Security Management Principles (CISMP) is a common starting point. A degree in computer science or cyber security helps but is not essential, and Level 4 and Level 6 cyber security apprenticeships offer paid routes in. Most job adverts look for experience of ISO 27001, incident response and supplier risk.
- Get an entry or mid-level security role, such as SOC analyst, security engineer or GRC analyst, and stay hands-on for several years.
- Take the BCS Foundation Certificate in Information Security Management Principles (CISMP) to learn the language of security management.
- Volunteer to help with ISO 27001 audits, Cyber Essentials submissions or risk registers so you can show governance experience.
- Work towards CISSP or CISM, which many manager adverts list and which require several years of verified security experience.
- Lead or support real incident response, including writing post-incident reports and presenting lessons learned to managers.
- Practise explaining risks in business terms, such as cost, legal exposure and customer impact, because you will report to directors and boards.
- Look into professional registration with the UK Cyber Security Council once you meet its experience requirements.
| Route | How long | Cost | Best for |
|---|---|---|---|
| Progress from security analyst or engineer | 5+ years | Certifications often employer-funded | People already in cyber security |
| Move across from IT infrastructure, risk or audit | 3-6 years | Certification costs vary | Experienced IT, risk or audit professionals |
| Cyber security degree apprenticeship, then progression | 3-4 years, then experience | Paid by the employer | School leavers planning a long-term security career |
| Cyber security degree or master's, then analyst roles | 1-3 years of study, plus experience | Tuition fee loan or postgraduate fees | Graduates and career changers |
How long it takes
Expect at least five years in security, IT or risk roles before stepping into an information security manager post. Holding CISSP or CISM can help you make the move sooner.
Information Security Manager salary in the UK
Information security managers usually start on around £55,000 to £70,000 when first stepping into the role. Experienced managers earn £75,000 to £95,000, and heads of security earn £100,000 to £150,000 or more. Financial services, technology and large regulated firms pay the most, and London roles sit at the top of the range. Certifications such as CISSP or CISM, security clearance for government and defence work, and experience leading incidents all push pay up.
Key skills
- ISO 27001 / NIST
- Risk management
- Leadership
- Incident response
Information Security Manager FAQs
How do I become an information security manager in the UK?
Build at least five years of experience in security, IT, risk or audit roles, then gain management-level certifications such as CISSP or CISM. Experience of ISO 27001, incident response and reporting to senior leaders is what moves you from analyst or engineer into management.
Do you need a degree to be an information security manager?
No. Many managers came up through IT support or apprenticeships. A degree in computer science or cyber security helps early on, but employers mostly look for experience, certifications such as CISSP, CISM or CISMP, and evidence you have run security programmes.
How much do information security managers earn in the UK?
Typical starting pay in the role is £55,000 to £70,000. Experienced managers earn £75,000 to £95,000, and heads of security earn £100,000 to £150,000 or more. Financial services, technology and London roles pay the most.
What is the difference between CISSP and CISM?
CISSP, from ISC2, covers a broad range of security topics, both technical and managerial. CISM, from ISACA, focuses on governance, risk and running a security programme. Both need several years of experience, and many manager adverts accept either.
Is Information Security Manager right for you?
Career Compass ranks careers from your interests and priorities and explains every suggestion, with UK routes and trade-offs. See how well Information Security Manager actually fits you. £19.99 once, full report included.
Still deciding whether information security manager is the career for you? Here is which career test is actually worth taking, and what a free quiz will not tell you.