[Hiring] Information Security Leader @Graitec

Role Description

This role owns information security, risk and compliance for Graitec: the certifications, the controls and the assurance that keep Graitec and our customers safe. It is commercially consequential: information security managed as a product and turned into business won and retained. The role is hands-on, writing the policy, running the audit and answering the difficult customer questions, and it is designed to grow into a broader leadership remit as the capability matures.

Key Outcomes Expected

• ISO 27001 certification and SOC 2 Type II attestation achieved through one efficient control programme
• An external trust centre live, with customer security questionnaires answered to an agreed SLA from a maintained and increasingly automated knowledge base
• Security visibly enabling revenue, with named regulated and public sector opportunities won or retained on the strength of our security position
• A prioritised information security risk register, owned by the business and reviewed at executive level
• Detection and response matured: consolidated tooling, tested playbooks, and time to detect and respond trending down
• External security ratings improved further
• A published position on AI security and acceptable use, with the AI estate inventoried and a clear approval route to be an enabler for innovation

Responsibilities

• Certification & Compliance
  • Own delivery of SOC 2 Type II and ISO 27001 as a single efficient control programme
  • Build and run the information security management system: policies, controls, evidence, internal audit and management review, and own the relationship with auditors and certification bodies
• Customer Assurance & Commercial Enablement
  • Run customer assurance: an external trust centre, a maintained questionnaire knowledge base, clear service levels back to Sales, and reporting on the commercial contribution of security
  • Represent Graitec on security with customers and prospects, including regulated and public sector accounts, and support contract negotiation with the Group Legal Director
• Security Operations & Engineering
  • Own detection and response, and run vulnerability, exposure and patch management to agreed targets, with the external attack surface actively managed
  • Own identity and access security with IT Operations & Platforms: privileged access, service accounts, conditional access, and joiner, mover and leaver controls
  • Own the security tooling roadmap and budget, consolidating the estate as required
• Cloud, Product & Web Security
  • Secure Graitec's public estate, platforms and hosted services, setting secure-by-design standards for cloud landing zones, integrations and customer-facing services
  • Extend remit to our intellectual property and product security, with a strong working interface into R&D
  • Embed secure development practice with R&D: secure SDLC, code and dependency scanning, secrets management, and penetration testing with tracked remediation
• Risk, Resilience & Governance
  • Build and maintain the information security risk register, with business ownership, an agreed risk appetite and executive-level reporting
  • Own third party and vendor security assessment, including periodic reassessment and secure offboarding, and provide security due diligence for acquisitions
  • Drive security governance for corporate AI: inventory and approval of tools and agents, AI access to corporate data, AI vendor risk, and responsible use
  • Own incident response and business continuity: run exercises, lead responses, and work with other functions on disaster recovery design and testing
  • Build security awareness that changes behaviour, with targeted training, phishing simulation and a strong culture of prevention

Qualifications

• Executive-level communication, with a track record of leading adoption and change across multinational, multidisciplinary teams
• Results-oriented mindset with a high degree of ownership and accountability
• Ability to operate effectively in a global and multicultural environment

Requirements

• Hands-on ownership of an information security programme in a software or SaaS business, with SOC 2 Type II and ISO 27001 carried end-to-end, and national schemes e.g., Cyber Essentials Plus or NIST CSF
• Strong working knowledge of the Microsoft security stack (Defender, Entra ID, Purview, Sentinel) and of managing an outsourced or co-managed SOC
• Cloud security, including landing zones, identity, securing internet-facing services, and penetration testing and vulnerability remediation with R&D teams
• Security risk management, third party assurance and GDPR obligations, working alongside a Data Protection Officer
• AI security and governance: securing AI agents that access corporate data, and setting the inventory, approval and acceptable use framework
• Comfortable as the only dedicated security professional, pragmatic and proportionate in a mid-sized, fast-moving business
• Commercially astute, credible in front of customers, and able to translate risk into business language
• Self-directed and evidence-driven, taking work to completion, and able to develop junior talent and mature a small team

Also valued

• CISSP, CISM, CISA, CRISC, CCSP, or ISO 27001 Lead Implementer or Lead Auditor
• Experience in M&A due diligence and integration, in an acquisitive or private equity-backed group
• Exposure to NIS2, DORA or the EU AI Act