Information Security Officer

TUI Group is the world’s number one integrated tourism business. The Security Domain is a global team within TUI technology responsible for leading Information Security risk management across TUI. We are a multi-disciplinary team of experts across Architecture, Engineering, DevOps and Agile Delivery providing services across the UK, Ireland, Sweden, Norway, Denmark, Finland, Germany, Belgium and The Netherlands. 

At TUI we’re ambitious to become the leader in technology within the travel industry and to achieve this we are looking to build a capable, creative team who want to be a part of accomplishing that goal. 

We never stop looking ahead, seeking new ways to delight our customers and grow our business. We recognise the power of digital and the massive contribution this brings to creating a truly unique and differentiated customer experience. 

We are looking for a talented and dedicated security leader to join the Governance, Risk and Compliance (GRC) team which supports the Group CISO in their responsibility to ensure information security risks are managed in alignment to our business goals across TUI Group.  

Information Security Officer is a senior leadership role (a member of the GRC Leadership Team), responsible for overseeing and supporting the application of TUI’s Information Security management framework across the Group.  Providing leadership, governance and a risk-based approach in managing security within specific areas of our business. You will partner with our business and technology leaders to deliver visibility and effective management of Information Security. 

ABOUT OUR OFFER

• Personal benefits: Attractive remuneration, bonus opportunity, exclusive travel perks & discounts, extensive health & wellbeing support, and more.
• Flexible working: Work is something you do, not somewhere you go. We encourage a healthy work-life balance and offer hybrid or remote working models.
• A career to shape: Opportunities to upskill, reskill and grow your career. Access the TUI Tech Learning Hub to level-up and reach your ambitions.
• Expand your horizons: Participate in our tech communities and collaborate on global projects and teams.
• Community: Get involved with incredible local charity and sustainability initiatives like the TUI Care Foundation and the Sustainable Tech Community. 

ABOUT THE JOB

• As an Information Security Officer, you will promote and inspire a security first culture at TUI.  
• You will direct the development, implementation, delivery and support of an enterprise Information Security strategy aligned to the strategic requirements of the business.
• Lead the provision of Information Security resources expertise, guidance and systems necessary to execute strategic and operational plans across all of the organisation’s information systems.  
• Ensure that each Domain is motivated and empowered to deliver the prioritised roadmap.  This will include protecting the TUI brand and its customers, detecting and responding to incidents, strengthening our defences, reducing the attack surface and securing our behaviours. 
• You will have extensive business knowledge and understand the impact of emerging practices and technologies.  
• Drive adoption of and adherence to security policies, standards and controls through the provision of expert advice and guidance.  
• Protect our most critical assets and ensure appropriate assurance and rigorous testing is in place.
• You will ensure security incidents are managed effectively through engagement with the security operations team, and that lessons learned and audit findings are remediated. Ensure effective security operations (e.g. vulnerability scanning, patching).
• Protect the integrity, availability, authenticity, non-repudiation and confidentiality of information and data in storage and in transit.  
• Manage risk in a pragmatic and cost-effective manner to ensure stakeholder confidence.  
• You will report on the overall effectiveness of the security programme on each Domain against defined key performance indicators and drive continuous improvement.  
• Our Information Security team works in collaboration with business and IT teams across our many businesses.
• You will build strong working relationships, explain and present complex ideas to audiences at all levels in a persuasive and convincing manner.  Instil secure ways of working and influence others to do the right thing to Protect our Smile.
• You will also lead workstreams focussed on the development of the GRC team from a people, process and tooling perspective. 

Security is part of everyone’s job. At TUI, we practise secure behaviours first in everything we do. 

ABOUT YOU 

• An experienced authentic leader with a good understanding of technology and managing Information Security risks in the enterprise. 
• Passionate about Information Security, delivering business value and driving continuous improvement. 
• Strong people leadership skills and experience in building a positive enabling security culture based on trust, quality and pragmatic risk management. 
• Great communicator and influencer comfortable working across hierarchical, organisational, cultural and market boundaries. 
• Experience of managing teams, mentoring  and developing security talent from different cultural backgrounds. 
• Professionally qualified holding a recognised security accreditation (CISSP/CISM/CISA etc.,) or equivalent experience with demonstrable Continuous Professional Development. 
• Maintain a good understanding of latest security threats and the mitigating strategies.  
• Ability to provide advice and guidance on security strategies to manage identified risks and ensure adoption and adherence to standards. 
• Experience of the implementation, operation and maintenance of an Information Security Management framework such as ISO27001 or NIST CSF. 
• Good understanding of integrating security into software or product development lifecycle and cloud security. 
• Experience of securing Amazon Web Services workloads is desirable. Certification in cloud security or architecture a nice-to-have. 
• Good understanding of the international regulatory context, particularly data privacy.  
• Good understanding of technology standards and control frameworks such as CIS, NIST, PCI, OWASP, ITIL and COBIT. 
• Adept at articulating IT security and technical issues to technical and non-technical audiences in a clear and actionable manner.  
• Experienced at gaining commitment at business unit board level. 
• Strong commercial acumen when taking actions or making decisions. 
• Open minded, inquisitive, life-long learner. 
• Comfortable with ambiguity, highly autonomous. 

From a workplace to a place to belong.  At TUI we embrace diversity, equity, and inclusion, encouraging everyone to come as you are, because together, our potential is limitless.

We are committed to supporting candidates with disabilities and impairments so if you require any support, please do let us know.