Job Description:

Location: Hybrid London or Midlands 
Start Date: ASAP

The Opportunity An established and rapidly growing software organisation is seeking an experienced Director of Information Security to lead and mature its security function during a critical growth phase.
This is a hands-on leadership role requiring a pragmatic security professional who can balance risk management, regulatory compliance, technology innovation, and business enablement. You will work closely with senior leadership to develop and execute a group-wide security strategy whilst ensuring security remains embedded throughout the organisation.
The successful contractor will be comfortable operating at both strategic and operational levels, engaging with board-level stakeholders while also driving technical security initiatives across infrastructure, applications, data, people, and processes.

Key Responsibilities

• Define and deliver the organisation's information security strategy and roadmap.
• Partner with business leaders to ensure security supports growth, transformation, and operational objectives.
• Develop and maintain a robust security framework incorporating industry best practices and a defence-in-depth approach.
• Drive organisation-wide security awareness, training, and human risk management initiatives.
• Lead identity and access management, endpoint security, and device governance programmes.
• Oversee application security, secure software development practices, vulnerability management, code scanning, and penetration testing activities.
• Support cloud security initiatives across multi-cloud environments using native security tooling and monitoring capabilities.
• Establish and enhance incident response processes, including playbooks, communications plans, and breach readiness procedures.
• Manage third-party supplier security assessments and vendor risk programmes.
• Ensure compliance with relevant regulatory and data protection requirements, including GDPR and emerging regulatory frameworks.
• Maintain and develop security governance, policies, controls, and audit readiness.
• Lead and support security certification programmes, including ISO 27001 and Cyber Essentials Plus.
• Provide guidance around the governance, adoption, and secure use of emerging technologies, including artificial intelligence.
• Support acquisition integration activities from a security due diligence and risk management perspective.
• Present risk, compliance, and security updates to executive leadership and key stakeholders.

Required Experience

• Proven experience in a senior Information Security leadership role, ideally Director, Head of Information Security, or CISO level.
• Strong understanding of security governance, risk management, compliance, and operational security.
• Experience leading security programmes within software, SaaS, technology, or product-led organisations.
• Expertise across application security, infrastructure security, cloud security, and information governance.
• Experience delivering and maintaining frameworks such as ISO 27001, Cyber Essentials Plus, NIST CSF, or similar.
• Strong knowledge of vulnerability management, security operations, incident response, and vendor risk management.
• Experience engaging with executive leadership and boards on security matters.
• Knowledge of M&A security reviews and post-acquisition integration is highly desirable.
• Excellent communication skills with the ability to influence both technical and non-technical stakeholders.

Desirable Skills

• Experience within regulated environments.
• Familiarity with AWS and/or Azure security services.
• Exposure to DORA, NIS2, and related regulatory frameworks.
• Security certifications such as CISSP, CISM, CRISC, or equivalent.