Burberry Cyber Security Risk Manager

About Burberry

Burberry Limited, a quintessentially British luxury fashion house, is renowned for its innovative designs and commitment to quality. As part of the global luxury conglomerate, Burberry offers a dynamic and inclusive work environment where creativity and excellence are at the forefront. The company is dedicated to fostering a culture that encourages diversity and sustainability, making it a leader in the luxury industry.

Role & Responsibilities

• Own and maintain delivery plans for assigned risk services; prioritise activities, monitor progress and quality, identify delivery risks or capacity constraints, and coordinate stakeholders to deliver outputs to standard and agreed timescales.
• Oversee third-party security due diligence and external security vendors; ensure assessments are risk-based and evidence-supported, record material gaps, assign remediation or risk acceptance to accountable owners, and support procurement stakeholders in understanding security implications before contractual commitment.
• Identify, assess and describe cyber risks arising from technology, business change, suppliers and control weaknesses; evaluate likelihood, impact and existing controls using the agreed methodology, and recommend pragmatic treatment options aligned with business context and risk appetite.
• Work with risk and action owners to define proportionate remediation plans, milestones and target dates; monitor progress, challenge overdue or insufficient responses, validate closure evidence where appropriate, and escalate material exposure or stalled remediation through governance channels.
• Maintain an accurate, current cyber risk register covering material exposure, ownership, treatment status and decisions; apply consistent risk language and quality standards, avoid duplication, and promptly reflect changes in exposure.
• Translate complex technical matters into concise business risk language for technical and non-technical audiences; prepare decision-ready materials for senior leaders, Executives and the Board, setting out the issue, potential business impact, current controls, recommended action, accountable owner and decision required.
• Perform cyber security governance activities, including business-as-usual cyber risk assessments, policy and standards development, contract reviews and third-party security due diligence; ensure outputs are consistent, traceable and aligned with organisational governance requirements.
• Author and maintain practical cyber security policies and standards; engage relevant stakeholders, make requirements implementable and support teams in applying them to services, projects and suppliers.
• Build cyber security risk understanding across IT and the wider business; challenge decisions where risk is not adequately considered, explain required controls and promote accountable, risk-informed decision-making.
• Use findings from risk assessments, incidents, assurance activity and stakeholder feedback to identify recurring themes and improve risk processes, templates, reporting and service quality; promote consistency and reduce avoidable delay or rework.

Qualifications

• Work independently enough to provide objective risk advice while collaborating with technology, procurement, legal, project and business stakeholders.
• Take ownership of assigned services and issues from initial assessment through to a clear decision, agreed treatment plan or documented risk acceptance.
• Use judgement to distinguish material risks from lower-priority issues and focus effort on areas with the greatest potential business impact.
• Maintain accuracy, consistency and evidential standards in risk records, reports and governance materials.
• Promptly escalate material, emerging or unresolved risks, clearly explaining the exposure, options and decision required.
• Balance security objectives with commercial and operational realities, recommending proportionate, achievable and sustainable controls.
• Handle sensitive information appropriately and demonstrate integrity, sound judgement and professional challenge in risk discussions.
• Engage and influence stakeholders at different levels of seniority; bring excellent communication, stakeholder management and relationship management skills, and broad knowledge of information and cyber security, technical security, cyber risk management, security best practice, standards, policy and governance.
• Understand complex technical processes and challenges, determine their business relevance and develop pragmatic solutions; apply a structured approach, sound judgement and confidence in constructive challenge.
• Plan and prioritise work, set clear delivery expectations, review output quality and collaborate with colleagues to achieve agreed outcomes.
• Demonstrate experience in cyber risk assessment, articulating risk in business terms and recommending proportionate treatment options.
• Have previous experience embedding cyber security requirements into contracts, procurement activity and projects.
• Manage conflicting priorities and multiple tasks, make risk-based prioritisation decisions and maintain delivery discipline.
• Author clear cyber risk and governance reports for Executive and Board-level audiences.
• Communicate credibly with technical specialists and non-technical stakeholders, adapting detail and language to the audience.
• Maintain risk records and track remediation actions through to evidenced closure or formally documented acceptance.
• Analyse incomplete or conflicting information, identify further evidence requirements and reach balanced, defensible conclusions.
• Show strong written attention to detail and produce concise, accurate, decision-focused documentation.

Skills

Culture

Burberry fosters a creative and inclusive workplace culture that values diversity and sustainability. The company is committed to being a force for good, driving industry change and championing community engagement.

About Cerulean

Cerulean is the definitive career portal for the global luxury industry. We match exceptional professionals with exclusive opportunities at the world's most prestigious brands. From haute couture and fine watchmaking to prestige beauty, hospitality, and boutique retail, Cerulean centralises luxury employment to help you find the career for which you were destined.