Head of Information Security and Compliance

The Role

This is the senior security role in the group, with responsibility for building and leading the security programme. You will hold the certifications, front the audits, and be the person customers, insurers and the board ultimately rely on.

The group has grown quickly through acquisition, with several entities in three countries at different levels of maturity and with overlapping but non-identical obligations. You will bring them into one coherent, credible programme and maintain it through future acquisitions, working with a small team and significant autonomy. Pragmatism matters more than process for its own sake.

What You'll Own

• ISO 27001 and Cyber Essentials Plus across every entity: scope, evidence, audits, recertification, and onboarding newly acquired businesses. If SOC 2 becomes commercially necessary, make that call and lead it.
• The ISMS and the policies behind it: current, genuinely used, and credible to an auditor.
• GDPR across three jurisdictions: processing records, DPIAs, transfers, subject requests, and breach notification.
• Customer security assurance: questionnaires, due-diligence packs, and security terms in contracts and DPAs. Join calls where deals are won or stalled on security.
• Incident response end to end: own the plan, run the response, and ensure post-mortems lead to change.
• Business continuity and disaster recovery for group systems, tested at least annually, plus tabletop exercises with the leadership team.
• Security baselines for endpoints and internal systems, including CRM, ERP, email and collaboration. IT Operations implements them; you set and verify the standards.
• Risk register, access reviews and control testing, reported directly to the executive team.
• External partners, including MSPs, penetration testers, security vendors, and the cyber-insurance relationship.
• Security awareness that people absorb rather than click through.

What This Role Is Not

Security of the SINGU product and its hosting infrastructure belongs to Platform Engineering. Day-to-day administration of laptops and internal systems belongs to IT Operations. You set the standards and hold both teams to them; you are not responsible for reimaging laptops.

What We're Looking For

• Experience leading information security and compliance, ideally as the most senior security person in a business.
• Experience taking ISO 27001 through at least one full audit cycle.
• Practical GDPR experience in more than one country.
• Experience maturing security across businesses at different stages, ideally in an acquisition-built group.
• Ability to build programmes pragmatically, distinguish real risk reduction from theatre, and protect business velocity.
• Credibility with customers, auditors and the board, with the ability to maintain a technical position without unnecessarily blocking deals.
• CISSP, CISM or equivalent.
• Strong professional English. Polish is useful but not essential.

Why You'll Want This

• Full ownership of security for an international SaaS group, with direct access to the executive team.
• A programme to shape rather than inherit, with real problems, budget, and mandate to fix them properly.
• Security is a visible commercial role that enables revenue.
• The group is growing; what you build becomes the standard for future acquisitions.
• Competitive salary aligned to the seniority of the role.
• Private medical care, sport card, life insurance, annual training budget, team integration budget, and more.