Original listing text, shown exactly as published by the company.
Key Responsibilities
- Own the IT & Security program: keep the calendar, track initiatives, and make sure nothing falls through the cracks. You are responsible for delivery, not for doing everything yourself.
- Coordinate IT initiatives such as tooling rollouts, IdP migrations, and access management projects, working with Infrastructure and IT to keep them scoped and on track.
- Run the compliance and certification cycles (SOC 2, ISO 27001, ISO 9001): coordinate with auditors, internal teams, and Legal to keep evidence collection and deadlines under control.
- Manage the pentest program end to end: scope, vendors, finding tracking, and remediation follow-up in collaboration with Security Engineers and Engineering.
- Drive the security awareness program together with People Ops: training campaigns, phishing simulations, and completion tracking.
- Coordinate risk and vendor reviews, keeping the risk register up to date and supporting enterprise sales with security questionnaires and due diligence requests.
- Report on program health to leadership with clear, consistent visibility into what is on track, what is at risk, and what needs decisions.
You will work alongside Security Engineers, IT, Infrastructure, Legal, and external vendors. Your job is to make the team more effective by owning the coordination layer, not to be a one-person department.
Qualifications
- 4+ years of experience in program management, IT operations, or a cybersecurity/GRC coordination role
- End-to-end ownership of at least one full SOC 2 or ISO 27001 cycle
- Strong understanding of multiple frameworks and how to map controls across them
- Working knowledge of GDPR, enterprise risk, and third-party risk
- Ability to operate independently and build structure from ambiguity
- Good enough understanding of IT and security to have credible conversations with engineers and auditors, without needing to be a hands-on technical practitioner
- Strong written and verbal communication: able to translate technical work into clear updates for non-technical audiences
- Highly organised, deadline-driven, and comfortable holding others accountable
