About the position:

The CyberSecurity Culture & Capability Manager is responsible for developing and embedding a strong cybersecurity culture across the JTI by driving behavioral change, strengthening workforce capability, improving adoption of secure practices, and governing information security communications. The role partners with Change Management, People & Culture (P&C), Learning & Development (L&D), Internal Communications, and Cyber Security teams.

Responsibilities:

• Cybersecurity Culture & Behaviour Change

Develop and execute the enterprise cybersecurity culture and capability roadmap aligned to security strategy.
Establish initiatives that drive measurable changes in cybersecurity awareness, behaviors, and accountability.
Partner with Change Management team to embed security adoption and behavioral reinforcement into business transformation initiatives.

• Capability Development & Learning

Partner with Change Management, P&C and L&D to integrate cybersecurity learning into onboarding, leadership, and development journeys.
Develop role-based security capability pathways.
Oversee modern, measurable cyber security learning programs.

• Security Communications & Engagement

Own and govern information security communications to ensure messaging is curated, consistent, clear,and business aligned.
Develop communication campaigns and editorial governance in partnership with Change Management Team.
Faciliate awareness initiatives, campaigns, and engagement activities.

• Human Risk & Behavioral Reinforcement

Coordinate phishing simulation and social engineering exercises.
Use simulation outcomes to improve learning, communications, and engagement.
Partner with cyber teams to align campaigns to emerging threats.
Measure behavior change and security culture maturity.

• Stakeholder Collaboration, Influence & Continuous Improvements

Build strong partnerships with Change Management, P&C, L&D, Internal Communications, and business leaders.
Act as a trusted advisor to security leadership on culture and adoption.
Define KPIs and reporting for culture, capability, communications, and human risk reduction.
Continuously improve programs using outcomes and insights.

Requirements:

• Bachelor's degree in Cyber Security, Information Technology, Business, Communications, Organizational Development, Learning & Development, Human Resources, Psychology, or a related discipline.
• Postgraduate qualification in Cyber Security, Organizational Change, Communications, Learning, or Business is desirable.
• Relevant certifications are advantageous (e.g., Security awareness,Organizational Change, Learning Design, Information Security).
• 7+ years of experience across cybersecurity, awareness, organizational change, learning, communications, or capability development.
• Experience designing and delivering enterprise-wide security culture or awareness programs.
• Experience deliviering phishing simulation and human risk reduction initiatives.
• Experience partnering with Change Management, P&C, and L&D functions.
• Experience developing executive communications and engagement strategies.
• Experience measuring culture and behavior outcomes using data and metrics.
• Fluent English written & spoken
• Security Culture & Behaviour Change
• Human Risk Management and Phishing Simulation
• Strategic Communications and Content Governance
• Stakeholder Engagement and Influence
• Learning Strategy and Adult Learning Principles
• Organizational Change Management
• Security Awareness Program Design
• Capability Framework Development
• Data Analysis and KPI Reporting
• Program and Portfolio Management
• Executive Communication and Presentation

Next Steps:

After applying, if selected, please anticipate the following within 1-3 weeks of the job posting closure: Phone screening with Talent Advisor > Assessment tests > Interviews > Offer. Each step is eliminatory and may vary by role type.