Head of Security in St Albans

Mr Who?

MrQ - we're an awesome, award winning online casino launched in 2018. We're big on tech, big on performance and most of all - big on fun. Over the years, we have experienced explosive growth - which means we need more rock stars to join our quest for total world domination.

This is a founding leadership role. We’re building a dedicated security function at MrQ, with its own strategy, roadmap, team and budget, and you’ll be the one building it.

You won’t start from zero, and you won’t be handed someone else’s plan. Serious groundwork is already in place: an independent security maturity baseline, a live GRC platform, EDR and identity programmes in deployment, and security investment with real backing from the exec team. The strategy and roadmap from here are yours to define. Pressure-test what’s in flight, keep what works, change what doesn’t.

You’ll report directly to the CTO and lead both Security and IT Operations. The Lead of IT Ops reports to you, and you’ll hire and lead the security engineering team, starting with a Principal Security Engineer.

This is a player-coach role. We need someone strategic enough to own board-level risk conversations, and technical enough to earn the respect of a Principal-level engineer and challenge architecture decisions on an AWS-native platform. With a small team and serious AI leverage, you’ll build as well as lead. Threat modelling, architecture reviews and AI-powered security tooling are part of the job, not beneath it. Here, automation replaces headcount by design.

What You Will Do

1. Own the security strategy

• Define and own the security strategy and maturity roadmap. Set priorities, allocate budget and effort, and be accountable for the targets you set.

• Report security posture, risk and investment cases to the CTO, exec team and board. Translate technical risk into business impact.

• Make sure security is part of every major technology and product decision, including how we build with AI, not just what we buy.

2. Build and lead the team

• Lead the IT Operations function through its Lead: identity and access, employee onboarding and offboarding, the device fleet, SaaS tools, and data requests (DSARs).

• Hire, develop and lead the security engineering team, starting with a Principal Security Engineer.

• Design the function for resilience: clear ownership, documented processes, no single points of failure.

3. Run security engineering and operations

• Own the security tooling end to end (EDR/XDR, SIEM, identity, vulnerability management, email security, DLP), including the deployments already in flight.

• Own security incident and breach response: deciding severity, directing containment, regulatory notification (ICO, UKGC) and post-incident review. Production incidents belong to Engineering’s on-call team. You own the security path and the call on when an incident is, or might become, a security event.

• Direct security across a cloud-native AWS estate: platform, payment flows, APIs, player data.

4. Own governance, risk and compliance

• Own the GRC programme: risk register, policies, control framework, audit readiness (ISO 27001 path, Cyber Essentials, GDPR) and the compliance-automation platform behind it.

• Partner with Compliance on the regulatory side of a UKGC-licensed operator: player data protection, technical standards, audit evidence.

• Build documentation to a standard that survives external scrutiny: auditors, regulators and commercial due diligence.

5. Secure how we build with AI

• MrQ is deeply AI-native: AI agents, internal AI platforms and AI-assisted engineering across the company. Own the security model for all of it: the AI gateway, agent permissions and sandboxing, data boundaries, and governance of third-party AI tools.

• Own the company’s AI usage policy: which tools are approved, what data they can touch, and what agents are allowed to do on their own.

• This is greenfield in most companies. Here it’s live production surface. Treat it as a first-class part of the threat model.

6. Build the security culture

• Own security awareness across the company: training, phishing simulations, onboarding inductions, and security champions inside the squads. Make security something people do, not something done to them.

7. Own the security vendor portfolio

• Own vendor selection, commercial relationships and spend across the security stack. Run build-vs-buy honestly. Kill tools that don’t earn their keep.
  

What We're Looking For

• 10+ years in security, including 3+ years leading a security function or team with real budget and hiring ownership

• Built or significantly matured a security function before: you’ve taken a company up a maturity curve, not just operated inside a mature one

• Deep technical credibility: you can hold your own with senior security and platform engineers on EDR, SIEM, identity and cloud security (AWS), and you know when to defer

• Direct experience owning GRC: policies, control frameworks, risk registers, and leading audits (ISO 27001, SOC 2, Cyber Essentials or equivalent)

• Led security incident response at company level: you’ve owned real incidents, not just contributed to them

• Managed managers or senior individual contributors, ideally including an IT operations remit

• Exec-level communicator: you can hold a board conversation about risk appetite and a whiteboard session about detection logic in the same day

• Pragmatist: balances risk with business enablement in a company that ships fast

• Builder’s mindset in the age of AI: you’d rather automate a control than staff it, and you use AI tooling to make a small team punch far above its weight

Highly Desirable

• iGaming, fintech or another heavily regulated industry; UKGC or similar gaming regulation and player data protection are a strong plus

• Experience securing AI/LLM systems: agent architectures, model access controls, AI tooling governance

• Experience preparing a security function for commercial due diligence or external investment scrutiny

• Application or product security background in a platform business

• Relevant senior certifications (CISSP, CISM, CCISO) or an equivalent proven track record
  

What We Offer

At MrQ, we take pride in providing an array of fantastic benefits to our valued team members. Enjoy a competitive salary package that recognizes your hard work and dedication. Need some extra time off? We've got you covered with additional leave days, and we believe in celebrating life's special moments, including your birthday, with dedicated birthday leave. Family matters to us, too, which is why we offer a generous four-week parental leave. Your well-being is our priority, supported by international health and life insurance. Stay motivated with wellness incentives and seize opportunities for personal and professional growth with our growth allowance. Embrace a flexible working environment that caters to your needs, and join our friendly and multinational team, where collaboration and camaraderie flourish. At MrQ, we're committed to ensuring that your experience with us goes beyond just a job – it's a fulfilling journey with a supportive community.

We are committed to fostering a workplace that values and celebrates diversity. We welcome individuals of all backgrounds and experiences, and we believe that a diverse and inclusive environment leads to innovation and success. We actively promote equal opportunities for all employees and strive to create a space where everyone's voices are heard and respected. Join us in our journey to build a truly inclusive workplace where every person can thrive and contribute to our collective success.

To help our recruitment team work efficiently, please apply to the role that best matches your skills and experience. Our team will consider you for other similar roles as well!