IT Security & Compliance Lead

IT Security & Compliance Lead at wordsmith. About the role Wordsmith develops artificial intelligence-driven command center solutions designed specifically for legal departments seeking to modernize their operations. The company is actively looking for a skilled professional to build out and lead the IT security function from the ground up while simultaneously managing compliance initiatives during a period of significant infrastructure growth. This position offers a unique opportunity to shape security strategy and governance practices at a rapidly scaling organization operating at the intersection of legal technology and artificial intelligence. You will serve as the primary owner of security operations and compliance frameworks, working cross‑functionally to protect company assets and maintain customer trust.

Key facts

Location: Edinburgh Engagement: Full-time Team: General and Administrative

What you'll do

• Administer and maintain device compliance programs across the organization, implementing and managing mobile device management solutions through platforms such as Jamf or Microsoft Intune to ensure all endpoints meet security standards and corporate policies.
• Take ownership of identity and access management processes, including user provisioning, deprovisioning, and enforcement of least‑privilege access principles using Okta as the primary identity platform to control authentication and authorization across all systems.
• Strengthen and secure cloud infrastructure by implementing robust security controls within Amazon Web Services environments, including network segmentation, encryption standards, logging configurations, and vulnerability management practices.
• Lead security incident response activities from initial detection through resolution, coordinating investigations with external Security Operations Center as a Service providers, managing communication with stakeholders, and conducting thorough post‑incident reviews to identify lessons learned and preventive measures.
• Deploy, configure, and maintain a comprehensive suite of security monitoring tools including endpoint detection and response solutions, data loss prevention systems, and security information and event management platforms to provide visibility into potential threats.
• Oversee the maintenance and continuous improvement of SOC 2 Type II certification along with ISO 27001, ISO 27017, and ISO 27018 certifications, implementing audit evidence automation to streamline compliance workflows and reduce manual documentation burdens.
• Conduct thorough security and privacy risk assessments for third‑party vendors, software tools, and artificial intelligence solutions before integration into the company technology stack, ensuring alignment with organizational risk tolerance and regulatory requirements.
• Contribute to the development and execution of the AI governance program, participating in internal risk reviews to evaluate potential security implications of machine learning models and automated decision‑making systems.
• Partner with Sales, Legal, and Customer Success teams to complete security questionnaires from prospective and existing customers, negotiate security‑related contract terms, and manage the external Trust Center to communicate the company security posture effectively.
• Develop and maintain security policies, procedures, and documentation that align with industry best practices and regulatory requirements while remaining practical for implementation across the organization.
• Create and deliver security awareness training programs to educate employees on emerging threats, phishing prevention, data handling practices, and their individual responsibilities in maintaining organizational security.
• Monitor the evolving threat landscape and regulatory environment to proactively identify risks and recommend appropriate countermeasures before they impact business operations.

Requirements

• Demonstrated experience managing IT security operations within a high‑growth software as a service company, with understanding of the unique challenges and pace associated with rapidly scaling technology organizations.
• Strong proficiency with mobile device management platforms, particularly Jamf for Apple ecosystem management or Microsoft Intune for cross‑platform device administration and compliance enforcement.
• Hands‑on technical background working with Okta for identity and access management, including single sign‑on configuration, multi‑factor authentication implementation, and lifecycle management automation.
• Practical experience securing Amazon Web Services environments, including familiarity with IAM policies, security groups, CloudTrail logging, GuardDuty threat detection, and other native AWS security services.
• Proven track record leading security incident response from detection through remediation, with ability to remain calm under pressure and coordinate effectively with internal and external stakeholders during active incidents.
• Working knowledge of SOC 2 Type II audit requirements and ISO 27000 series standards, with experience preparing evidence, managing auditor relationships, and addressing findings.
• Experience deploying and operating endpoint detection and response, data loss prevention, or security information and event management platforms in production environments.
• Strong collaboration skills with demonstrated ability to work effectively across IT, Engineering, and Go‑To‑Market functions to achieve security objectives without impeding business velocity.

Nice to have

• Familiarity with General Data Protection Regulation requirements and emerging AI governance frameworks such as ISO 42001 for artificial intelligence management systems.
• Professional certifications demonstrating security and privacy expertise, such as Certified Information Systems Security Professional, Certificate of Cloud Security Knowledge, Certified Information Privacy Professional for Europe, or AI Governance Professional credentials.
• Previous experience working within legal technology, artificial intelligence, or other regulated software as a service sectors where security and compliance requirements are particularly stringent.
• Hands‑on experience with specific security and compliance tools including Vanta for compliance automation, Crowdstrike for endpoint protection, Zscaler for secure access, Datadog for monitoring, or Whistic for security questionnaire management.
• Background in building security programs from early stages rather than inheriting mature existing frameworks.
• Experience with secure software development lifecycle practices and ability to partner with engineering teams on application security initiatives.

Skills & tools

• Mobile Device Management platforms including Jamf and Microsoft Intune
• Identity and Access Management using Okta
• Cloud Security within Amazon Web Services environments
• Security Operations tooling including Endpoint Detection and Response, Data Loss Prevention, and Security Information and Event Management solutions
• Compliance frameworks including SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018
• Vendor risk assessment and third‑party security evaluation
• Security awareness training and policy development
• Incident response and forensic investigation coordination

Practical notes

This position follows a hybrid working arrangement based out of the Edinburgh office location. Regular in‑office presence is expected to enable effective collaboration with product, engineering, and legal teams who work closely with security and compliance functions. The role reports into the General and Administrative organization and will have significant visibility with leadership given the critical nature of security and compliance in building customer trust and enabling enterprise sales. Candidates should be prepared to balance strategic planning with hands‑on technical work, particularly during the initial phase of building