Cyber Security Lead - Edinburgh

Harvey Nash Group; City of Edinburgh; Hybrid; GBP 70,000 - 80,000; Full time

Benefits offered by this job

Hybrid working

Two days in Edinburgh office per week

30 days annual leave + birthday off

Enhanced parental leave

Company pension with employer contrib.

Learning & development budget

Opportunity to work directly with CTO

Job summary

Harvey Nash is partnering with a fast-growing technology business delivering critical digital infrastructure to the UK public sector to recruit a Security & Assurance Lead in Edinburgh. This role blends hands-on cloud security engineering with governance, risk and compliance, working directly with the CTO to shape security as the business grows.

Hybrid working with two days in the Edinburgh office, ownership of security strategy, ISO 27001 and Cyber Essentials Plus, vulnerability management,

Qualifications

• Hands-on cybersecurity engineering experience, ideally in AWS.
• Experience implementing ISO 27001 and Cyber Essentials Plus.
• Practical experience in vulnerability management and threat modelling.
• Ability to communicate security risks clearly to senior stakeholders.

Responsibilities

• Take ownership of the organisation's cybersecurity function, security strategy, policies and controls.
• Lead ISO 27001 and Cyber Essentials Plus certification and ongoing compliance activities.
• Oversee cloud security across an AWS-based serverless environment.
• Manage vulnerability assessments, penetration testing and remediation activities.
• Embed security into development pipelines, including SAST, dependency scanning and secrets management.
• Conduct threat modelling and security risk assessments for new applications, features and integrations.
• Lead security incident response, detection engineering and security monitoring activities.
• Develop and maintain security documentation, risk registers, security playbooks and assurance reporting.
• Work closely with government cybersecurity stakeholders to demonstrate compliance and security assurance.
• Implement AI-assisted security automation to improve monitoring, vulnerability management and compliance evidence gathering.
• Oversee access governance, security awareness and data protection activities.

Skills

Cybersecurity engineering

ISO 27001

Cyber Essentials Plus

DevSecOps

Threat modelling

Vulnerability management

AWS cloud

Security policies & governance

Risk communication

AI-driven security automation

Job description

Security & Assurance Lead | £70,000-£80,000 | Edinburgh (Hybrid)

Location: Edinburgh, Leith (2 days per week in the office)

Salary: £70,000-£80,000

Contract: Permanent, Full-time

Working Pattern: Hybrid

The Opportunity

Harvey Nash is partnering with a fast-growing technology business delivering critical digital infrastructure to the UK public sector to recruit a Security & Assurance Lead.

This is an exciting opportunity to become the organisation's first dedicated security hire, taking full ownership of its cybersecurity strategy, technical security controls and governance framework.

Working directly with the CTO, you'll play a pivotal role in shaping the security function as the business expands across the UK and internationally.

The role offers a unique combination of hands-on cloud security engineering and governance, risk and compliance (GRC), with responsibilities split approximately 50/50 between technical security and assurance.

Key Responsibilities

• Take ownership of the organisation's cybersecurity function, security strategy, policies and controls.
• Lead ISO 27001 and Cyber Essentials Plus certification and ongoing compliance activities.
• Oversee cloud security across an AWS-based serverless environment.
• Manage vulnerability assessments, penetration testing and remediation activities.
• Embed security into development pipelines, including SAST, dependency scanning and secrets management.
• Conduct threat modelling and security risk assessments for new applications, features and integrations.
• Lead security incident response, detection engineering and security monitoring activities.
• Develop and maintain security documentation, risk registers, security playbooks and assurance reporting.
• Work closely with government cybersecurity stakeholders to demonstrate compliance and security assurance.
• Implement AI-assisted security automation to improve monitoring, vulnerability management and compliance evidence gathering.
• Oversee access governance, security awareness and data protection activities.

Skills & Experience Required

• Strong hands-on cybersecurity engineering experience, ideally within AWS cloud environments.
• Proven experience implementing or managing ISO 27001 and/or Cyber Essentials Plus certification.
• Practical experience in vulnerability management, penetration testing coordination and threat modelling.
• Understanding of DevSecOps, CI/CD security and secure software development practices.
• Experience developing security policies, risk assessments and assurance documentation.
• Ability to communicate technical security risks clearly to senior stakeholders and non-technical audiences.
• Experience using AI assistants or automation workflows to improve security processes.
• Comfortable taking ownership of security independently in a growing technology environment.

Desirable Experience

• Knowledge of NCSC guidance and Cloud Security Principles.
• Experience working with public sector organisations or government security assurance teams.
• Familiarity with AWS Lambda, serverless architecture and GitHub Actions.
• SIEM, detection engineering and incident response experience.
• Knowledge of UK GDPR, DPIAs and data protection requirements.
• Certifications such as CISSP, CISM or AWS Certified Security Specialty.

What's on Offer?

• Competitive salary of £70,000-£80,000.
• Hybrid working with just 2 days per week in the Edinburgh office.
• 30 days annual leave plus your birthday off.
• Enhanced parental leave.
• Company pension with employer contributions.
• Dedicated learning and development budget.
• Opportunity to work directly with the CTO and influence technical decision-making.
• Significant autonomy to build and shape the organisation's security function.
• Opportunity to contribute to a growing technology platform supporting critical public services.

Additional Information

Applicants must have the right to work in the UK and be eligible for BPSS clearance.