Information Security Lead

Join to apply for the Information Security Lead role at HowNow. Our mission is to make meaningful learning a part of your everyday. The shelf life of our skills is now less than 5 years. So, if you stopped learning today, your skills would soon become irrelevant. Enter HowNow. Founded in 2019, our Learning and Skills Platform is disrupting the way people learn and upskill through technology. Whether it’s finding a quick answer, learning new skills, or tapping into shared knowledge, we make it easy for people to learn what they need, when they need it.

As our first InfoSec hire, you will be our subject matter expert, guiding our fast-growing Learning Tech SaaS platform with your practical knowledge on everything security-related. You’ll be responsible for identifying, assessing, and mitigating risks for the business, as well as developing processes and controls to support our commercial, engineering, and product teams.

Day-to-day tasks will include:

• Security Ownership & Leadership: Own and lead HowNow’s information security function, working cross-functionally to align with business needs. Maintain and evolve our ISO 27001 certification and manage the ISMS lifecycle. Perform regular risk assessments, manage remediation plans, and conduct internal audits. Ensure compliance with data protection laws (e.g., GDPR) and customer security requirements. Create and manage information security policies, standards, and procedures. Deliver internal training, onboarding, and awareness programs to promote secure behaviours.
• Security Operations: Work with engineering and DevOps to implement security controls across infrastructure (e.g., access control, encryption, logging). Lead the incident response process and manage third-party pen testing and vulnerability management. Support security questionnaires, RFPs, and due diligence for customer deals. Review third-party vendors and tools for security posture and risks.

The key qualities we’re looking for in applicants:

• 3–5 years of hands-on experience in an information security or IT risk/compliance role.
• Experience working at a SaaS company or fast-paced startup/scale-up.
• Good working knowledge of ISO 27001 and experience maintaining or achieving certification.
• Understanding of cloud environments (AWS preferred) and common SaaS security risks.
• Hands-on knowledge of endpoint protection, SIEMs, DLP, IAM, and SSO.
• Clear understanding of data privacy laws (especially GDPR).
• Familiarity with security tools (e.g., endpoint protection, SSO/IAM, monitoring/logging, vulnerability scanning).
• Experience with risk assessments, incident response planning, and writing security policies.
• Strong communication skills, with the ability to explain security concepts to both technical and non-technical teams.

What you’ll get:

• Salary band for this role is £60,000-75,000 per annum, plus a 10% performance-based bonus.
• Hybrid working (2x a week in our London office, Tuesdays and Thursdays) and flexible working hours.
• Work From Anywhere, for up to two weeks per quarter.
• Wind-down Fridays: No meetings from 2 pm onwards on Fridays.
• Enhanced maternity and paternity policies.
• 25 days holiday, plus bank holidays and your birthday off.
• An annual £500 learning and development budget.
• Dog-friendly offices.
• Monthly socials, including mini-golf, Hijingo, shuffleboarding, 5-a-side football, and badminton.
• Access to the best learning platform (HowNow+) to keep you at the top of your game.
• Cycle to Work scheme.
• Financial wellbeing support via Mintago.

What’s next? Once you’ve applied, we’ll get back to you within 3 working days. You’ll be invited to a 30-minute video call with Lizzie, our Senior People Partner, followed by a 45-minute interview with Kuvera (COO & Co-Founder). You will deliver a short task detailing how you’d approach a risk assessment, mitigation plan, compliance, governance, and penetration testing.