Security Operations & GRC Manager in Glasgow

AccessFintech is seeking a senior Information Security professional to join our Technology function. This is a broad remit spanning three areas — AFT's internal information security posture, our governance, risk and compliance programme, and the security relationship with AFT's client network.

As a capital markets technology provider handling sensitive financial data for over 250 institutions, client security confidence is as important as internal security rigour, and both rest on a well-run compliance and assurance programme. This role requires someone who can operate credibly across all three — running robust security operations, owning the certification and risk framework, and engaging directly with clients on security due diligence, assessments, and trust-building conversations.

You will report directly to the CTO and work closely with engineering, product, client operations, and solutions teams across all three jurisdictions.

1. Internal Information Security

• Own and continuously improve AFT's information security posture across infrastructure, applications, cloud environments, and endpoints

• Lead the operation and evolution of AFT's security tooling — SIEM, EDR, vulnerability management, intrusion detection, and identity and access management (IAM)

• Own AFT's vulnerability management programme — regular assessments, remediation tracking, and risk reporting to the CTO and executive team

• Lead security incident response — identification, containment, investigation, remediation, and post-incident review

• Maintain and develop AFT's information security policies, standards, and procedures across all three jurisdictions

• Embed security into AFT's software development lifecycle (SDLC) — partnering with engineering and DevOps to shift security left

• Design and deliver security awareness training and communications across the global team

2. Client-Facing Security

• Act as AFT's primary point of contact for all client security enquiries, assessments, and due diligence requests

• Own the end-to-end response to client information security questionnaires — including standardised formats such as the Shared Assessments SIG and CSA CAIQ, as well as bespoke questionnaires issued by banks, custodians, and asset managers

• Build and maintain a central answer library so questionnaire responses are consistent, accurate, and efficient to produce — reducing turnaround times and removing reliance on ad hoc drafting

• Coordinate input from engineering, DevOps, legal, and compliance where questions fall outside the existing answer set, and quality-assure all responses before issue

• Manage annual reassessments and periodic client re-certification cycles, ensuring responses remain current as the platform and control environment evolve

• Represent AFT in client-facing security discussions, audits, and on-site or virtual security assessments — building confidence in AFT's security posture at senior level

• Support the client onboarding process from a security and compliance perspective — ensuring new clients can satisfy their own internal security requirements for onboarding AFT

• Partner with Client Operations and Solutions teams to proactively manage client security requirements as part of the commercial relationship

• Maintain AFT's security documentation suite — trust centre content, security overview decks, penetration test summaries, and compliance certificates — keeping them current and client-ready

• Track and manage client-raised security findings, ensuring remediation actions are progressed and communicated back to clients in a timely manner

• Contribute to new business conversations where security posture is a factor — working with Sales and Solutions on RFP responses and client presentations

3. Governance, Risk & Compliance (GRC)

• Own AFT's information security governance framework — policies, standards, and control documentation across all three jurisdictions

• Own and maintain AFT's information security risk register — identifying, assessing, and tracking risks across internal and client-facing dimensions, with defined risk appetite and escalation thresholds

• Own AFT's ISO 27001 and SOC 2 programmes end to end — control design, evidence collection, internal audit, gap remediation, and management of external auditors through certification and surveillance cycles

• Maintain regulatory compliance mapping across UK (FCA, UK GDPR), US (SEC), and Israel (Privacy Protection Law), ensuring controls are traceable to obligations

• Own the third-party and vendor security risk assessment programme — onboarding due diligence, ongoing monitoring, and contractual security requirements

• Own the control testing and assurance calendar, ensuring controls are evidenced continuously rather than reconstructed at audit

• Establish and run the security governance cadence — regular reporting to the CTO and executive team, translating technical risk into business-level insight

• Lead preparation for external security audits, regulatory examinations, and client-initiated security reviews

Skills & Experience

Essential

• 6–10 years of progressive experience in information security or cybersecurity, including at least 2 years in a client-facing or externally-engaged security role

• Proven experience owning client information security questionnaires at volume — including standardised formats (SIG, CAIQ) and bespoke bank or custodian questionnaires — with a track record of building an answer library rather than responding ad hoc

• Experience managing client-raised security findings through to remediation, and reporting outcomes back to client security teams

• Demonstrable experience owning a GRC programme — running an ISO 27001 or SOC 2 certification cycle end to end, including evidence management, internal audit, and managing external auditors

• Experience building and maintaining an information security risk register, with the ability to articulate risk appetite and escalate appropriately

• Experience managing third-party and vendor security risk assessment programmes

• Strong hands-on security operations experience — SIEM (e.g. Splunk, Microsoft Sentinel), EDR, vulnerability management (e.g. Tenable, Qualys), and IAM

• Deep working knowledge of information security frameworks — ISO 27001, SOC 2, NIST CSF — and experience maintaining or achieving certification

• Strong background in cloud-native applications and architectures, with cloud security expertise across IAM, network security, and cloud-native security monitoring

• Strong understanding of data privacy and regulatory obligations in financial services — GDPR, FCA, SEC, or equivalent — including mapping controls across multiple regimes

• Excellent communication skills — able to translate complex security concepts into clear, confident language for client security teams, legal and compliance functions, and non-technical business stakeholders

• Comfortable engaging at senior level with client security and technology teams — building trust and managing relationships through complex due diligence processes

Desirable

• Relevant security certifications — CISSP, CISM, CRISC, CISA, CEH, or equivalent

• ISO 27001 Lead Implementer or Lead Auditor certification

• Experience in capital markets, fintech, or regulated financial services — familiarity with the security expectations of buy-side, sell-side, or custodian institutions

• Experience with DevSecOps practices — integrating security into CI/CD pipelines and engineering workflows

• Scripting or automation capability — Python, PowerShell, or Bash — for security tooling and reporting

• Experience building or maintaining a client trust centre or security documentation programme

• Experience with GRC tooling and compliance automation platforms

• AWS specifically is an advantage — hands-on experience securing containerised and serverless workloads, and using AWS-native security services such as GuardDuty, Security Hub, and Config