Senior Information Security Officer

ACT is strengthening its data, technology and AI capabilities as it builds a more integrated digital platform alongside its core environmental commodities trading and market-making business. As Senior Information Security Officer, you will own ACT's enterprise information security strategy and governance at Group level, spanning core operations, emerging digital businesses and client-facing technology platforms. You will define the security risk appetite, lead the response to an evolving threat landscape, and ensure security and resilience are embedded by design as the technology landscape develops. Working across business and technology leadership, you will translate commercial ambition into a pragmatic and scalable security posture that protects systems and data while maintaining the trust of clients, counterparties and regulators.

• Own the Group-wide information security strategy and roadmap across ACT's core market-making business and digital and client-facing platforms, aligned with business goals and industry frameworks such as ISO 27001 and NIST CSF, and define and maintain ACT's cyber risk appetite.
• Establish and lead security governance, including policies, standards and control frameworks, with clear accountability across the Group, and report on security posture and material incidents to executive leadership and, where relevant, the Board.
• Embed security-by-design into new products and client platforms, partnering with Data, Architecture and Commercial teams so emerging digital capabilities are secure from inception, and act as a credible security voice to clients and counterparties.
• Oversee application, product and SaaS security, embedding security throughout the software development lifecycle for internal and client-facing platforms, and assess third-party services handling ACT and counterparty data.
• Lead enterprise security risk management, including risk assessments, vulnerability management and third-party/supply-chain risk, driving timely mitigation across core and digital environments.
• Direct incident preparedness and response, coordinating detection, containment, eradication and recovery, and continuously strengthen incident and crisis-management plans.
• Secure ACT's cloud and infrastructure through Zero-Trust-aligned controls, including identity and access management, segmentation and encryption, across a hybrid and multi-platform environment.
• Govern emerging technology and AI security, extending security oversight to AI and data platforms, including model and data-exposure risks and AI-enabled threats.
• Ensure regulatory and compliance alignment, including GDPR, DORA and relevant sector obligations, advising the business on required adaptations and coordinating audits and certifications.
• Lead the security function and strengthen security culture across the Group, developing the team, raising security awareness, and acting as ACT's primary authority and trusted advisor on cyber security to executives and business leaders.