Director of Information Security

SoCode (United Kingdom); Cambridge; Hybrid; GBP 120,000 - 170,000; Full time

Job summary

SoCode is seeking a Director of Information Security to lead the security function during a critical growth phase. This hands‑on leadership role balances risk management, regulatory compliance, technology innovation, and business enablement, engaging with senior leadership and boards.

The role covers governance, identity and access management, cloud security, and secure development practices across infrastructure, applications, data, people and processes, with a defence‑in‑depth approach.

Qualifications

• Senior Information Security leadership experience
• Experience implementing ISO 27001/Cyber Essentials Plus
• Knowledge of GDPR, NIS2, DORA
• Strong governance, risk and compliance focus

Responsibilities

• Define and deliver the information security strategy and roadmap.
• Partner with business leaders to align security with growth and operations.
• Develop and maintain a robust security framework with defence in depth.
• Drive security awareness and human risk management across the org.
• Lead IAM, endpoint security, and device governance programmes.
• Oversee application security, secure SDLC, vulnerability management, code scanning, and pentesting.
• Support cloud security across multi‑cloud environments.
• Establish incident response processes, playbooks, and breach readiness.
• Manage third‑party security assessments and vendor risk programmes.
• Ensure GDPR and regulatory compliance; maintain governance, controls and audit readiness.
• Lead security certification programmes such as ISO 27001 and Cyber Essentials Plus.
• Provide guidance on emerging tech governance and secure AI use.
• Support security due diligence for acquisitions.
• Present risk, compliance and security updates to executives.

Skills

Security leadership

Governance compliance

ISO 27001

Cyber Essentials Plus

NIST CSF

Cloud security

Vulnerability management

Board engagement

Vendor risk

Communication skills

Education

CISSP

CISM

CRISC

Job description

Location: Hybrid London or Midlands
Start Date: ASAP

The Opportunity
An established and rapidly growing software organisation is seeking an experienced Director of Information Security to lead and mature its security function during a critical growth phase.

This is a hands‑on leadership role requiring a pragmatic security professional who can balance risk management, regulatory compliance, technology innovation, and business enablement. You will work closely with senior leadership to develop and execute a group-wide security strategy whilst ensuring security remains embedded throughout the organisation.

The successful contractor will be comfortable operating at both strategic and operational levels, engaging with board-level stakeholders while also driving technical security initiatives across infrastructure, applications, data, people, and processes.

Key Responsibilities

• Define and deliver the organisation's information security strategy and roadmap.
• Partner with business leaders to ensure security supports growth, transformation, and operational objectives.
• Develop and maintain a robust security framework incorporating industry best practices and a defence-in-depth approach.
• Drive organisation-wide security awareness, training, and human risk management initiatives.
• Lead identity and access management, endpoint security, and device governance programmes.
• Oversee application security, secure software development practices, vulnerability management, code scanning, and penetration testing activities.
• Support cloud security initiatives across multi-cloud environments using native security tooling and monitoring capabilities.
• Establish and enhance incident response processes, including playbooks, communications plans, and breach readiness procedures.
• Manage third‑party supplier security assessments and vendor risk programmes.
• Ensure compliance with relevant regulatory and data protection requirements, including GDPR and emerging regulatory frameworks.
• Maintain and develop security governance, policies, controls, and audit readiness.
• Lead and support security certification programmes, including ISO 27001 and Cyber Essentials Plus.
• Provide guidance around the governance, adoption, and secure use of emerging technologies, including artificial intelligence.
• Support acquisition integration activities from a security due diligence and risk management perspective.
• Present risk, compliance, and security updates to executive leadership and key stakeholders.

Required Experience

• Proven experience in a senior Information Security leadership role, ideally Director, Head of Information Security, or CISO level.
• Strong understanding of security governance, risk management, compliance, and operational security.
• Experience leading security programmes within software, SaaS, technology, or product‑led organisations.
• Expertise across application security, infrastructure security, cloud security, and information governance.
• Experience delivering and maintaining frameworks such as ISO 27001, Cyber Essentials Plus, NIST CSF, or similar.
• Strong knowledge of vulnerability management, security operations, incident response, and vendor risk management.
• Experience engaging with executive leadership and boards on security matters.
• Knowledge of M&A security reviews and post‑acquisition integration is highly desirable.
• Excellent communication skills with the ability to influence both technical and non‑technical stakeholders.

Desirable Skills

• Experience within regulated environments.
• Familiarity with AWS and/or Azure security services.
• Exposure to DORA, NIS2, and related regulatory frameworks.
• Security certifications such as CISSP, CISM, CRISC, or equivalent.