Head of Information Security

Beware of Fraudulent Mercury Job Postings. Fraudsters may be posting fake job listings claiming to be from Mercury. Legitimate Mercury job offers will never ask for personal information or upfront payments. Always verify job postings through official Mercury channels.

Head of Information Security, Dublin, Ireland Mercury is the European leader in construction solutions.

We build and manage complex engineering & construction projects for the world's leading corporations. Our solutions help deliver technologies and life changing advancements that connect people, communities, and businesses, giving them the power to achieve incredible things. Our people have the courage to be innovative. Their determination and sharp focus enable us to deliver with certainty, time and time again.

We deliver our clients' visions through leading edge construction solutions across multiple sectors, including Enterprise Data Centres, Advanced Technology & Life Sciences, Hyperscale Data Centres, Fire Protection.

At Mercury, it is our duty to encourage and back our people to realise their vision of themselves. We place them at the heart of what we do, providing challenging opportunities to develop within a great team in a supportive environment that allows them to reach their full potential.

Scope of the Role:

We are seeking a Head of Information Security to own and lead the information security function for Mercury Engineering. Reporting to the Head of IT, the successful candidate will set the direction of our security, compliance and third-party risk agenda, and translate it into a funded, measurable programme of work.

This is a strategic leadership role rather than a hands-on operations role. The Head of Information Security is accountable for the overall security posture of the organisation: the design and maintenance of the information security management system, the way security risk is identified, quantified and reported to senior leadership, the assurance we provide to clients, and the management of security risk introduced through our supply chain and joint venture partners. Day-to-day monitoring and response activity is delivered through internal specialists and managed security service providers, whom this role directs and holds to account.

The role carries influence well beyond the IT function. The successful candidate will be expected to engage credibly with executive leadership, client security teams, auditors, insurers and Tier 1 suppliers, and to represent Mercury's security position in commercial and contractual discussions.

Key Responsibilities of the Role:

Security Strategy and Governance

• Security strategy: Define, own and maintain a multi-year information security strategy and roadmap aligned to Mercury's business plan, client commitments and risk appetite. Secure senior leadership endorsement and review the strategy at least annually.
• Governance framework: Own the information security policy framework, standards and supporting procedures. Ensure they remain current, proportionate, understood by the business, and consistent with the requirements of the sectors we build in.
• Executive and board reporting: Produce and present clear reporting on security posture, risk, incidents and programme delivery to the Head of IT, executive leadership and relevant committees. Translate technical exposure into commercial and operational terms.
• Assurance and control effectiveness: Establish a control assurance approach that evidences whether controls are operating as designed, using a combination of internal testing, independent assessment and audit.
• Metrics: Define and report a meaningful set of security and compliance metrics, and use them to direct investment and prioritisation rather than simply to describe activity.

Information Security Risk Management

• Risk framework: Own the information security risk management methodology, risk register and treatment planning. Ensure security risk is captured, owned by the business and escalated consistently with Mercury's wider enterprise risk process.
• Risk assessment: Direct regular risk assessments across the corporate estate, project environments and site-based technology. Ensure findings translate into funded, tracked remediation with clear ownership.
• Risk acceptance: Advise business owners on residual risk, articulate options and consequences clearly, and administer a defensible exception and risk acceptance process.
• Emerging risk: Maintain awareness of the threat landscape relevant to construction and to our clients' sectors, and of emerging risk areas such as artificial intelligence adoption, operational technology on site, and cloud concentration.

Compliance and Certification

• ISO/IEC 27001:2022: Act as the senior owner of the information security management system. Maintain and continually improve the ISMS, direct internal audit and management review, own the corrective action process, and lead preparation for and engagement with the certification body across surveillance and recertification audits.
• Scope management: Manage the certified scope of the ISMS, including changes arising from new business, new locations, acquisitions and changes to service delivery models.
• Regulatory compliance: Maintain oversight of information security obligations arising from applicable law and regulation, including data protection legislation and network and information security requirements, working with Legal, Data Protection and Compliance colleagues to ensure obligations are met and evidenced.
• Contractual compliance: Ensure security commitments given to clients are understood, achievable and demonstrably met, and that gaps are identified before they become findings.
• Frameworks and benchmarking: Assess Mercury's posture against recognised frameworks and client-mandated standards, and use the results to prioritise improvement.

Third-Party and Supply Chain Risk

• Programme ownership: Design, implement and own a third-party information security risk management programme covering suppliers, subcontractors, joint venture partners, agency labour providers and technology vendors.
• Due diligence: Establish risk-based due diligence and tiering for new and existing third parties, and lead assessment of Tier 1 relationships personally.
• Contractual controls: Work with Procurement, Legal and Commercial to embed appropriate security, confidentiality, incident notification, audit and data handling obligations in contracts, pre-qualification and tender documentation.
• Ongoing monitoring: Maintain continuous oversight of third-party security performance, including periodic reassessment, remediation tracking, and escalation where a supplier's posture presents unacceptable risk to Mercury or our clients.
• Site and project supply chain: Address the specific characteristics of construction supply chains, including short-notice mobilisation, transient workforces, shared site environments and client-imposed security requirements on subcontractors.
• Fourth-party and concentration risk: Understand and report on material dependencies held by our key suppliers, and on concentration risk within critical services.

Security Operations Oversight

• Service provider governance: Own the relationship with managed security service providers delivering managed detection and response, endpoint protection and vulnerability management as a service. Set expectations, govern performance against service levels, review outputs critically and drive continual improvement.
• Operational direction: Direct the internal security team in the delivery of monitoring, vulnerability management, identity and access governance, and security tooling administration, ensuring priorities reflect assessed risk.
• Security architecture: Provide security input and approval into technology change, infrastructure design, cloud adoption and project delivery, working with infrastructure and applications colleagues to embed security by design.
• Vulnerability and patch assurance: Set standards for vulnerability identification and remediation across the estate, and hold technical owners to account for closure within agreed timeframes.

Incident Response and Resilience

• Incident management: Own the security incident response framework. Lead the response to significant security incidents, including containment decisions, internal and external communications, regulatory and client notification, investigation and post-incident review.
• Preparedness: Run regular exercises and simulations with technical teams and senior leadership so that response capability is tested rather than assumed.
• Resilience: Contribute security requirements to business continuity and disaster recovery planning, and assure the recoverability of critical systems and data.
• External engagement: Maintain appropriate relationships with law enforcement, national cyber authorities, insurers and specialist response providers, and coordinate with them when required.

Security Culture and Awareness

• Awareness programme: Own the company-wide security awareness and training programme, including phishing simulation, role-based training and onboarding, and measure its effect on behaviour rather than completion rates alone.
• Senior engagement: . click apply for full job details