Information Security Officer

What you'll do

Who you are

• A hands-on information security professional with experience delivering cyber compliance in the defence or government supply chain.
• Practical experience running Cyber Essentials / Cyber Essentials Plus certifications and working to DEF STAN 05‐138 and the MOD's supplier cyber protection requirements.
• Solid experience implementing or auditing an ISO 27001 ISMS. A Lead Implementer or Lead Auditor qualification, or certifications such as CISSP or CISM, is a plus.
• Enough technical depth in cloud identity, endpoint management, and network security to judge controls in practice, not just on paper.
• Familiarity with UK Government Security Classifications and MOD security requirements for industry is a strong advantage.
• Able to explain security clearly and pragmatically to engineers, leadership, and auditors alike.

What we offer

• A mission driven environment with the opportunity to work on one of Europe’s most consequential defence challenges, with direct impact on sovereign capability and security.
• Daily collaboration with top experts across engineering, operations, and defence, with real opportunity to learn from the best, contribute, and grow.
• High ownership and autonomy; no time tracking, no micromanagement, just clear objectives and accountability for outcomes.
• A fast paced environment where good ideas are implemented quickly, and feedback from test and flight drives real decisions.
• A culture that values clarity, integrity, and excellence, and supports people who take initiative and push boundaries responsibly.
• Competitive compensation and real share options aligned to responsibility and impact, not tenure or hierarchy.

Additional information

Preferred Qualifications

• Solid experience implementing or auditing an ISO 27001 ISMS. A Lead Implementer or Lead Auditor qualification, or certifications such as CISSP or CISM, is a plus.

Responsibilities

• Own day-to-day information security and cyber compliance for our UK operations, working closely with the CISO and the wider group security function.
• Lead the annual Cyber Essentials Plus renewal from start to finish: defining the scope, finding and fixing gaps, gathering evidence, and working with the certification body through the assessment.
• Get the company ready to meet DEF STAN 05‐138 at higher cyber risk levels. That means gap analysis, a prioritised roadmap, putting controls in place, and building the evidence that MOD supplier cyber risk assessments need.
• Maintain and improve our ISO 27001 ISMS, including risk assessments, the Statement of Applicability, policies, internal audits, and management reviews.
• Run information security risk management and threat modelling, and turn the results into clear priorities for the business.
• Work with IT and infrastructure teams on technical controls, including identity and access management, endpoint hardening, vulnerability management, logging and monitoring, and backup and recovery.
• Manage supplier and subcontractor security, including flowing contractual cyber requirements down to them and assessing their security posture.
• Own the incident response plan, run exercises, and coordinate response and reporting to customers and authorities when incidents happen.
• Deliver security awareness training suited to a fast-moving engineering organisation.
• Report security posture, risks, and compliance status to leadership in clear, actionable terms.