Information Security Manager

EngineersOfAI; Cambridge; On-site; GBP 70,000 - 110,000; Full time

Job summary

EngineersOfAI in Cambridge is seeking an Information Security Manager to ensure our speech-to-text platform stays secure as it scales. You will shape security governance, risk and compliance while translating policy into practical controls across infrastructure and code.

Lead security triage, run hands-on audits, and automate GRC tasks to reduce busywork. You will become the go-to security expert for product and engineering, partnering with teams to keep data safe and systems robust.

Responsibilities

• Leading security triage as the first port of call, assessing new CVEs, vulnerabilities and supply-chain risk against our real infrastructure.
• Running hands-on audits covering pen testing, vulnerability management, supply-chain security, bringing technical judgement, not just policy references.
• Owning our governance, risk and compliance frameworks, and keeping them honest, turning policy into controls that actually work at the infrastructure and code level.
• Automating the parts of GRC that don't need a human (vulnerability tooling, endpoint protection rollout, policy-to-enforcement mapping), so the function scales without the busywork.
• Building real product and infrastructure knowledge, so you become the person people come to, not the person who has to go find someone else.

Job description

We built our speech-to-text engine to understand every voice, in every accent, in every language, across customers who trust us with their audio and their data. That same care extends to how we protect that data and our own systems, and that's where you come in. We're hiring an Information Security Manager to make sure the rigour we put into understanding speech is matched by the rigour we put into keeping it safe.

What you'll do

• Leading security triage as the first port of call, assessing new CVEs, vulnerabilities and supply-chain risk against our real infrastructure, not just a checklist.
• Running hands-on audits covering pen testing, vulnerability management, supply-chain security, bringing technical judgement, not just policy references.
• Owning our governance, risk and compliance frameworks, and keeping them honest, turning policy into controls that actually work at the infrastructure and code level.
• Automating the parts of GRC that don't need a human (vulnerability tooling, endpoint protection rollout, policy-to-enforcement mapping), so the function scales without the busywork.
• Building real product and infrastructure knowledge, so you become the person people come to, not the person who has to go find someone else.

What you'll bring