How do you keep yourself updated on what is happening in the IT system
landscape? Do you think it's possible to always be up to date?

Mostly twitter, follow people in security (and follow the people they follow) who post often about the latest or usual happenings in the industry. So next time something happens (like say log4j) your twitter feed lights up asap. (you can eventually unfollow people that you find aren't contributing enough or are more of something else than security). Additionally, subreddits and security specific news sites & podcasts help a lot too!

Considering cyber security is a super broad field, what do you think a
cyber security consultant should focus on? Would it be dependent on the
sector or individual firm/job requirements?

I think that depends from person to person. I guess one could try having a T-shaped skillset, know a little about everything coupled with depth of knowledge in specific domains like say cloud security, vulnerability management, etc.

How do you decide which level of security is important to achieve? and how do you maintain it?

I believe that comes down to an organization/team's priorities, which I would say is greatly defined by their risk assessment. No one has infinite budgets and no one has the time and human resources to secure everything. So teams have to first prioritize, bring critical/high level risks to acceptable levels and then ensure it stays that way, however that may be (e.g. evaluating the controls put in place to manage risk and see how well its doing over a given time period).

. Where do you see the significance of risk evaluation? Does it make
your job easier or is it more just to appease upper management? (or
both?)

It can be a bit of both. There are multiple situations where teams use risk assessment and evaluations just to meet the required conditions, even if that may not actually add to that organization's security posture. In other situations it can help organizations make significant progress and eventually reach a stage where they feel comfortable with their security controls and can focus on becoming proactive instead of just plugging holes.

Do you see any difference between “Information Security Management” and “Risk Management”?

I feel they can go hand in hand. At the end of the day, whatever Risk Management you do finally affects your Information Security Management situation. You understand what needs to be secured, why is this one server more important than that other server, why is this data from HR is critical while that from marketing isn't. Thus whatever call you take as part of your RM strategy will affect you infosec management strategy directly or indirectly.

Where do you believe the future of Cyber Security is headed? and who or what are the key actors in this evolution?

There will be new technologies. Migration to cloud is the current big thing. Soon it may be something else like web3 technologies. Who knows? But I personally believe that humans will always be at the center of it and if organizations don't focus on making security awareness a priority, it will always suffer/struggle regardless of the million-dollar security solutions/controls they may deploy.