Information Security Leader

Business Purpose & Value Contribution

This role owns information security, risk and compliance for Graitec: the certifications, the controls and the assurance that keep Graitec and our customers safe.

It is commercially consequential: information security managed as a product and turned into business won and retained. The role is hands-on, writing the policy, running the audit and answering the difficult customer questions, and it is designed to grow into a broader leadership remit as the capability matures.

Key Outcomes Expected

What success looks like in the first 12 months

• ISO 27001 certification and SOC 2 Type II attestation achieved through one efficient control programme
• An external trust centre live, with customer security questionnaires answered to an agreed SLA from a maintained and increasingly automated knowledge base
• Security visibly enabling revenue, with named regulated and public sector opportunities won or retained on the strength of our security position
• A prioritised information security risk register, owned by the business and reviewed at executive level
• Detection and response matured: consolidated tooling, tested playbooks, and time to detect and respond trending down
• External security ratings improved further
• A published position on AI security and acceptable use, with the AI estate inventoried and a clear approval route to be an enabler for innovation

Responsibilities

Certification & Compliance

• Own delivery of SOC 2 Type II and ISO 27001 as a single efficient control programme
• Build and run the information security management system: policies, controls, evidence, internal audit and management review, and own the relationship with auditors and certification bodies

Customer Assurance & Commercial Enablement

• Run customer assurance: an external trust centre, a maintained questionnaire knowledge base, clear service levels back to Sales, and reporting on the commercial contribution of security
• Represent Graitec on security with customers and prospects, including regulated and public sector accounts, and support contract negotiation with the Group Legal Director

Security Operations & Engineering

• Own detection and response, and run vulnerability, exposure and patch management to agreed targets, with the external attack surface actively managed
• Own identity and access security with IT Operations & Platforms: privileged access, service accounts, conditional access, and joiner, mover and leaver controls
• Own the security tooling roadmap and budget, consolidating the estate as required

Cloud, Product & Web Security

• Secure Graitec's public estate, platforms and hosted services, setting secure-by-design standards for cloud landing zones, integrations and customer-facing services
• Extend remit to our intellectual property and product security, with a strong working interface into R&D
• Embed secure development practice with R&D: secure SDLC, code and dependency scanning, secrets management, and penetration testing with tracked remediation

Risk, Resilience & Governance

• Build and maintain the information security risk register, with business ownership, an agreed risk appetite and executive-level reporting
• Own third party and vendor security assessment, including periodic reassessment and secure offboarding, and provide security due diligence for acquisitions
• Drive security governance for corporate AI: inventory and approval of tools and agents, AI access to corporate data, AI vendor risk, and responsible use
• Own incident response and business continuity: run exercises, lead responses, and work with other functions on disaster recovery design and testing
• Build security awareness that changes behaviour, with targeted training, phishing simulation and a strong culture of prevention

• Hands-on ownership of an information security programme in a software or SaaS business, with SOC 2 Type II and ISO 27001 carried end-to-end, and national schemes e.g., Cyber Essentials Plus or NIST CSF
• Strong working knowledge of the Microsoft security stack (Defender, Entra ID, Purview, Sentinel) and of managing an outsourced or co-managed SOC
• Cloud security, including landing zones, identity, securing internet-facing services, and penetration testing and vulnerability remediation with R&D teams
• Security risk management, third party assurance and GDPR obligations, working alongside a Data Protection Officer
• AI security and governance: securing AI agents that access corporate data, and setting the inventory, approval and acceptable use framework
• Comfortable as the only dedicated security professional, pragmatic and proportionate in a mid-sized, fast-moving business
• Commercially astute, credible in front of customers, and able to translate risk into business language
• Self-directed and evidence-driven, taking work to completion, and able to develop junior talent and mature a small team

Also valued

• CISSP, CISM, CISA, CRISC, CCSP, or ISO 27001 Lead Implementer or Lead Auditor
• Experience in M&A due diligence and integration, in an acquisitive or private equity-backed group
• Exposure to NIS2, DORA or the EU AI Act

• Executive-level communication, with a track record of leading adoption and change across multinational, multidisciplinary teams
• Results-oriented mindset with a high degree of ownership and accountability.
• Ability to operate effectively in a global and multicultural environment.