Information Security Leader in London

Overview

This role owns information security, risk and compliance for Graitec: the certifications, the controls and the assurance that keep Graitec and our customers safe. It is commercially consequential: information security managed as a product and turned into business won and retained. The role is hands-on, writing the policy, running the audit and answering the difficult customer questions, and it is designed to grow into a broader leadership remit as the capability matures.

Key Outcomes Expected

• ISO 27001 certification and SOC 2 Type II attestation achieved through one efficient control programme.
• An external trust centre live, with customer security questionnaires answered to an agreed SLA from a maintained and increasingly automated knowledge base.
• Security visibly enabling revenue, with named regulated and public sector opportunities won or retained on the strength of our security position.
• A prioritised information security risk register, owned by the business and reviewed at executive level.
• Detection and response matured: consolidated tooling, tested playbooks, and time to detect and respond trending down.
• External security ratings improved further.
• A published position on AI security and acceptable use, with the AI estate inventoried and a clear approval route to be an enabler for innovation.

Responsibilities

• Certification & Compliance: Own delivery of SOC 2 Type II and ISO 27001 as a single efficient control programme. Build and run the information security management system: policies, controls, evidence, internal audit and management review, and own the relationship with auditors and certification bodies.
• Customer Assurance & Commercial Enablement: Run customer assurance: an external trust centre, a maintained questionnaire knowledge base, clear service levels back to Sales, and reporting on the commercial contribution of security. Represent Graitec on security with customers and prospects, including regulated and public sector accounts, and support contract negotiation with the Group Legal Director.
• Security Operations & Engineering: Own detection and response, and run vulnerability, exposure and patch management to agreed targets, with the external attack surface actively managed. Own identity and access security with IT Operations & Platforms: privileged access, service accounts, conditional access, and joiner, mover and leaver controls. Own the security tooling roadmap and budget, consolidating the estate as required.
• Cloud, Product & Web Security: Secure Graitec's public estate, platforms and hosted services, setting secure-by-design standards for cloud landing zones, integrations and customer-facing services. Extend remit to our intellectual property and product security, with a strong working interface into R&D. Embed secure development practice with R&D: secure SDLC, code and dependency scanning, secrets management, and penetration testing with tracked remediation.
• Risk, Resilience & Governance: Build and maintain the information security risk register, with business ownership, an agreed risk appetite and executive-level reporting. Own third party and vendor security assessment, including periodic reassessment and secure offboarding, and provide security due diligence for acquisitions. Drive security governance for corporate AI: inventory and approval of tools and agents, AI access to corporate data, AI vendor risk, and responsible use. Own incident response and business continuity: run exercises, lead responses, and work with other functions on disaster recovery design and testing. Build security awareness that changes behaviour, with targeted training, phishing simulation and a strong culture of prevention.

Qualifications

• Hands-on ownership of an information security programme in a software or SaaS business, with SOC 2 Type II and ISO 27001 carried end-to-end, and national schemes e.g., Cyber Essentials Plus or NIST CSF.
• Strong working knowledge of the Microsoft security stack (Defender, Entra ID, Purview, Sentinel) and of managing an outsourced or co-managed SOC.
• Cloud security, including landing zones, identity, securing internet-facing services, and penetration testing and vulnerability remediation with R&D teams.
• Security risk management, third party assurance and GDPR obligations, working alongside a Data Protection Officer.
• AI security and governance: securing AI agents that access corporate data, and setting the inventory, approval and acceptable use framework.
• Comfortable as the only dedicated security professional, pragmatic and proportionate in a mid-sized, fast-moving business.
• Commercially astute, credible in front of customers, and able to translate risk into business language.
• Self-directed and evidence-driven, taking work to completion, and able to develop junior talent and mature a small team.

Also valued:

• CISSP, CISM, CISA, CRISC, CCSP, or ISO 27001 Lead Implementer or Lead Auditor.
• Experience in M&A due diligence and integration, in an acquisitive or private equity-backed group.
• Exposure to NIS2, DORA or the EU AI Act.

Executive-level communication, with a track record of leading adoption and change across multinational, multidisciplinary teams. Results-oriented mindset with a high degree of ownership and accountability. Ability to operate effectively in a global and multicultural environment.