Information Security & Compliance Lead (GRC)
- Job Title: Information Security & Compliance Lead
- Location: Oxfordshire - Hybrid 2 days per week on site
- Industry: Enterprise SaaS / Technology Solutions
About the Role
We are partnering with a fast-growing, globally active software and data solutions enterprise looking to appoint an experienced Lead level Information Security & Compliance specialist (GRC).
In this position, you will drive the operational security initiatives necessary to achieve and maintain formal security frameworks and attestation standards (including SOC 2 Type I/II lifecycles). You will translate complex trust criteria into practical, sustainable controls, bridge operational gaps, coordinate external audits, and elevate day-to-day security engineering across cloud platforms, products, and supply chains. Collaborating closely with engineering, product, legal, and operational teams, you will ensure security measures are robust, scalable, and integrated seamlessly without causing business friction.
Key Responsibilities
- Assurance & Audit Management: Own the compliance roadmap from initial readiness assessments through to operating effectiveness and annual recurring audits; coordinate third-party auditors and evidence gathering.
- Control Engineering: Design, implement, and refine technical controls covering identity and access management, cloud security architecture, encryption, logging, monitoring, and endpoint protection.
- Risk & Governance: Maintain risk registers, execute supplier security due diligence, manage exception workflows, and deliver targeted security awareness programmes across internal teams.
- Vulnerability & Incident Operations: Strengthen patching schedules, penetration test remediation, secure change management, backup validation, and incident response procedures.
- Cross-Functional Collaboration: Partner with engineering and product groups to embed security-by-design principles into software delivery pipelines and operational workflows.
Key Requirements
- Experience: Proven professional background delivering or materially supporting SOC 2 compliance readiness programmes or equivalent independent security audits within a cloud-first or SaaS environment.
- Technical Expertise: Hands-on experience engineering and testing security controls across major cloud infrastructure, IAM systems, endpoint tools, and SIEM monitoring platforms.
- Framework Knowledge: Strong working familiarity with trust service criteria, information security risk models (such as ISO 27001, NIST, or CIS benchmarks), and third-party risk principles.
- Competencies: Strong project ownership, excellent cross-functional communication skills, analytical rigor, and the ability to translate technical risk for diverse stakeholders.
- Qualifications: Relevant degree in Computer Science, Cyber Security, or equivalent practical experience, backed by recognized security or auditing certifications (such as CISSP, CISA, CCSP, or similar credentials).
