Information Security Manager

EngineersOfAI; Greater London; On-site; GBP 70,000 - 110,000; Full time

Job summary

EngineersOfAI is hiring an Information Security Manager to ensure the rigour we apply to our speech technology is matched by the security of our data and systems. You’ll lead security triage, CVE assessments, and risk governance across our infrastructure and code.

You’ll own governance, risk and compliance, run hands-on audits (pen testing, vulnerability management, supply-chain security), and automate GRC so the function scales.

Responsibilities

• Leading security triage as the first port of call, assessing new CVEs, vulnerabilities and supply-chain risk against our real infrastructure, not just a checklist.
• Running hands-on audits covering pen testing, vulnerability management, supply-chain security, bringing technical judgement, not just policy references.
• Owning our governance, risk and compliance frameworks, and keeping them honest, turning policy into controls that actually work at the infrastructure and code level.
• Automating the parts of GRC that don't need a human (vulnerability tooling, endpoint protection rollout, policy-to-enforcement mapping), so the function scales without the busywork.
• Building real product and infrastructure knowledge, so you become the person people come to, not the person who has to go find someone else.

Job description

We built our speech-to-text engine to understand every voice, in every accent, in every language, across customers who trust us with their audio and their data. That same care extends to how we protect that data and our own systems, and that's where you come in. We're hiring an Information Security Manager to make sure the rigour we put into understanding speech is matched by the rigour we put into keeping it safe.

What you'll do

• Leading security triage as the first port of call, assessing new CVEs, vulnerabilities and supply-chain risk against our real infrastructure, not just a checklist.
• Running hands-on audits covering pen testing, vulnerability management, supply-chain security, bringing technical judgement, not just policy references.
• Owning our governance, risk and compliance frameworks, and keeping them honest, turning policy into controls that actually work at the infrastructure and code level.
• Automating the parts of GRC that don't need a human (vulnerability tooling, endpoint protection rollout, policy-to-enforcement mapping), so the function scales without the busywork.
• Building real product and infrastructure knowledge, so you become the person people come to, not the person who has to go find someone else.

What you'll bring