Cyber Security Risk Manager

INTRODUCTION

At Burberry, we believe creativity opens spaces. Our purpose is to unlock the power of imagination to push boundaries and open new possibilities for our people, our customers and our communities. This is the core belief that has guided Burberry since it was founded in 1856 and is central to how we operate as a company today.   

We aim to provide an environment for creative minds from different backgrounds to thrive, bringing a wide range of skills and experiences to everything we do. As a purposeful, values-driven brand, we are committed to being a force for good in the world as well, creating the next generation of sustainable luxury for customers, driving industry change and championing our communities. 

JOB PURPOSE

The Cyber security Risk Manager has a global remit and is an integral member of the Cyber security team. The role is responsible for providing clear, evidence-based cyber security risk insight that informs strategy, supports investment decisions and enables projects and business change to adopt appropriate security controls.

The role delivers core Cyber security risk services, including third-party supplier security assessments, cyber risk reviews, maintenance of the cyber risk register, governance support and input to the annual Cyber security Risk Assessment report. The role is expected to plan and prioritise its workload, maintain consistent quality, escalate material issues promptly and ensure agreed actions are followed through to closure.

Success in the role means that decision-makers understand the cyber risks relevant to them, risk decisions are recorded and supported by clear analysis, and security requirements are embedded into projects, procurement and supplier relationships in a proportionate and practical way.

RESPONSIBILITIES

• Delivery planning and coordination: Own and maintain delivery plans for assigned risk services, prioritise activities, monitor progress and quality, and identify delivery risks or capacity constraints. Coordinate effectively with colleagues and stakeholders to ensure required outputs are completed to the expected standard and within agreed timescales.
• Third-party and vendor oversight: Oversee third-party security due diligence and the work of external security vendors. Ensure assessments are risk-based, conclusions are supported by evidence, material gaps are clearly recorded, and remediation or risk acceptance is assigned to an accountable owner. Play a key role in procurement by helping stakeholders understand security implications before contractual commitment.
• Cyber risk identification and assessment: Identify, assess and clearly describe cyber risks arising from technology, business change, suppliers and control weaknesses. Evaluate likelihood, impact and existing controls using the agreed risk methodology, and recommend pragmatic treatment options that reflect business context and risk appetite.
• Risk treatment and follow-through: Work with risk and action owners to define proportionate remediation plans, clear milestones and target dates. Monitor progress, challenge overdue or insufficient responses, validate closure evidence where appropriate and escalate material exposure or stalled remediation through the relevant governance route.
• Risk register management: Maintain an accurate and current cyber risk register that provides a reliable view of material exposure, ownership, treatment status and decisions. Apply consistent risk language and quality standards, avoid duplication, and ensure changes in exposure are reflected promptly.
• Stakeholder communication and executive reporting: Translate complex technical matters into concise business risk language for technical and non-technical audiences. Prepare decision-ready materials for senior leaders, Executives and the Board, clearly setting out the issue, potential business impact, current controls, recommended action, accountable owner and decision required.
• Cyber security governance: Perform Cyber security governance activities, including business-as-usual cyber risk assessments, policy and standards development, contract reviews and third-party security due diligence. Ensure outputs are consistent, traceable and aligned to the organisation’s governance requirements.
• Policy and standards: Author and maintain clear, practical Cyber security policies and standards. Engage relevant stakeholders during development, convert requirements into implementable expectations and support teams in understanding how the requirements apply to their services, projects and suppliers.
• Risk culture and awareness: Build understanding of cyber security risk across IT and the wider business. Constructively challenge decisions where risk is not adequately considered, explain the rationale for required controls and promote accountable, risk-informed decision-making rather than compliance as a tick-box exercise.
• Continuous improvement: Use findings from risk assessments, incidents, assurance activity and stakeholder feedback to identify recurring themes and improve risk processes, templates, reporting and service quality. Promote consistency and reduce avoidable delay or rework.

PERSONAL PROFILE

• Operate with sufficient independence to provide objective risk advice, while working collaboratively with technology, procurement, legal, project and business stakeholders.
• Take ownership of assigned services and issues from initial assessment through to a clear decision, agreed treatment plan or documented risk acceptance.
• Apply judgement to distinguish material risks from lower-priority issues and focus effort on the areas of greatest potential business impact.
• Maintain high standards of accuracy, consistency and evidence in risk records, reports and governance materials.
• Escalate material, emerging or unresolved risks promptly, with a clear explanation of the exposure, options and decision required.
• Balance security objectives with commercial and operational realities, recommending controls that are proportionate, achievable and sustainable.
• Handle sensitive information appropriately and demonstrate integrity, sound judgement and professional challenge in all risk discussions.

Skills Required:

• The successful candidate must be able to engage and influence key stakeholders at different levels of seniority. Excellent communication, stakeholder management and relationship management skills are essential, together with broad knowledge of information and cyber security, technical security, cyber risk management, security best practice, standards, policy and governance.
• Critical to success is the ability to understand complex technical processes and challenges, determine their business relevance and develop pragmatic solutions. The role requires a structured approach, sound judgement and the confidence to challenge constructively when risks are not adequately understood or managed.
• Proven experience of planning and prioritising work, setting clear delivery expectations, reviewing output quality and working collaboratively with colleagues to achieve agreed outcomes.
• Demonstrable experience of cyber risk assessment, including articulating risk in business terms and recommending proportionate treatment options
• Previous experience of embedding cyber security requirements into contracts, procurement activity and projects.
• Ability to manage conflicting priorities and multiple tasks, make risk-based prioritisation decisions and maintain delivery discipline.
• Experience of authoring clear cyber risk and governance reports suitable for Executive and Board-level audiences.
• Ability to communicate credibly with both technical specialists and non-technical stakeholders, adapting detail and language to the audience.
• Experience of maintaining risk records and tracking remediation actions through to evidenced closure or formally documented acceptance.
• Ability to analyse incomplete or conflicting information, identify what further evidence is required and reach a balanced, defensible conclusion.
• Strong written attention to detail and the ability to produce concise, accurate and decision-focused documentation.

Burberry is an Equal Opportunities Employer and as such, treats all applications equally and recruits purely on the basis of skills and experience.