Information Security & Compliance Lead (GRC)

Tank Recruitment; Oxford; On-site; GBP 70,000 - 110,000; Full time

Job summary

Tank Recruitment seeks an experienced Information Security & Compliance Lead (GRC) to own SOC 2 readiness and attestation programs for a cloud-first SaaS platform. You translate trust criteria into practical controls and coordinate audits across engineering, product, and operations.

The role covers IAM, cloud security, encryption, logging, monitoring, and incident response, with responsibility for risk registers, supplier due diligence, and security awareness.

Qualifications

• Experience delivering SOC 2 readiness programmes or equivalent audits in a cloud-first/SaaS environment.
• Hands-on experience engineering and testing security controls across cloud infrastructure, IAM, endpoints, and SIEM.
• Familiarity with trust service criteria, ISO 27001, NIST, CIS benchmarks, and third-party risk principles.

Responsibilities

• Own the compliance roadmap from readiness assessments to operating effectiveness and annual audits.
• Design, implement, and refine controls for IAM, cloud security, encryption, logging, and monitoring.
• Maintain risk registers, manage supplier security due diligence, and lead security awareness programs.
• Embed security-by-design principles into software delivery pipelines and operational workflows.

Skills

SOC 2

Cloud security

IAM

SIEM

Security audits

Risk management

Cross-functional communication

Education

Bachelor's degree in Computer Science or Cyber Security

CISSP, CISA, CCSP or similar certifications

Job description

Information Security & Compliance Lead (GRC)

Job Title: Information Security & Compliance Lead

Location: Oxfordshire - Hybrid 2 days per week on site

Industry: Enterprise SaaS / Technology Solutions

About the Role

We are partnering with a fast-growing, globally active software and data solutions enterprise looking to appoint an experienced Lead level Information Security & Compliance specialist (GRC). In this position, you will drive the operational security initiatives necessary to achieve and maintain formal security frameworks and attestation standards (including SOC 2 Type I/II lifecycles). You will translate complex trust criteria into practical, sustainable controls, bridge operational gaps, coordinate external audits, and elevate day-to-day security engineering across cloud platforms, products, and supply chains. Collaborating closely with engineering, product, legal, and operational teams, you will ensure security measures are robust, scalable, and integrated seamlessly without causing business friction.

Key Responsibilities

• Assurance & Audit Management: Own the compliance roadmap from initial readiness assessments through to operating effectiveness and annual recurring audits; coordinate third-party auditors and evidence gathering.
• Control Engineering: Design, implement, and refine technical controls covering identity and access management, cloud security architecture, encryption, logging, monitoring, and endpoint protection.
• Risk & Governance: Maintain risk registers, execute supplier security due diligence, manage exception workflows, and deliver targeted security awareness programmes across internal teams.
• Vulnerability & Incident Operations: Strengthen patching schedules, penetration test remediation, secure change management, backup validation, and incident response procedures.
• Cross-Functional Collaboration: Partner with engineering and product groups to embed security-by-design principles into software delivery pipelines and operational workflows.

Key Requirements

• Experience: Proven professional background delivering or materially supporting SOC 2 compliance readiness programmes or equivalent independent security audits within a cloud-first or SaaS environment.
• Technical Expertise: Hands‑on experience engineering and testing security controls across major cloud infrastructure, IAM systems, endpoint tools, and SIEM monitoring platforms.
• Framework Knowledge: Strong working familiarity with trust service criteria, information security risk models (such as ISO 27001, NIST, or CIS benchmarks), and third-party risk principles.
• Competencies: Strong project ownership, excellent cross-functional communication skills, analytical rigor, and the ability to translate technical risk for diverse stakeholders.
• Qualifications: Relevant degree in Computer Science, Cyber Security, or equivalent practical experience, backed by recognized security or auditing certifications (such as CISSP, CISA, CCSP, or similar credentials)