Information Security & Risk Officer

Accurx; London Borough of Hackney; Sur place; GBP 65 000 - 75 000; Plein temps

Avantages offerts par ce poste

£15k equity options

Healthcare & pension benefits

Life insurance

Office-based 3 days/week in Shoreditch

Hackathons and user-site visits

Résumé du poste

Accurx is seeking a Security & Compliance professional to lead risk management, security governance, and data strategy across Engineering, DevOps and Product. You’ll fight to protect patient data while enabling fast, compliant product delivery.

You’ll report to the Senior Information Security Officer and contribute to ISO 27001, DSPT, CE/CE+ and risk registers, driving practical fixes and secure architectures in a busy health-tech environment.

Qualifications

• Hands-on infosec and risk experience ideally in health-tech, regulated SaaS or software dev.
• Technical depth to hold your own: authentication vs authorisation, least privilege, IAM, network segmentation and firewalls.
• Understand ISO 27001, DSPT, NIST and Cyber Essentials Plus, and know what proportionate means in a fast-moving product company.

Responsabilités

• Own risk management: run risk sessions, keep the risk register current, write risk reports, chase actions.
• Advise the business: be the security voice with Engineering, DevOps, IT and Product; first contact for security questions.
• Handle customers, tenders and suppliers: answer security questionnaires and assess suppliers.
• Keep us audit-ready: gather evidence for Cyber Essentials Plus, DSPT and ISO 27001; flag gaps with fixes.
• Deliver our data strategy: drive data classification and access control programs.

Connaissances

Infosec risk management

GRC

Security advisory

Auditing readiness

Data strategy

Outils

IAM

Network segmentation

Firewalls

Patch & vulnerability management

Cloud security

Description du poste

Accurx is solving healthcare productivity for the NHS.

For decades, the NHS has struggled with fragmented systems that make simple tasks feel impossible. At Accurx, we're changing that by building a single, system-wide platform that helps every patient get gold-standard, efficient, and joined-up care.

What started as a way for GPs to text a patient has now evolved into an all-in-one digital toolkit used by 98% of GP practices.

Our platform now powers Total Triage to manage patient demand, and Self-Book, which lets patients schedule their own appointments in seconds. We've automated routine care with Patient Questionnaires for long-term conditions, while Accumail finally allows staff-to-staff communication to happen instantly across different care settings. We're now pushing the boundaries of the consultation itself with Accurx Scribe, our AI-powered note-taker that drafts medical notes in real-time.

We're not just shipping features. We're giving clinicians their time back and ensuring every patient journey is as smooth as it should be.

The role

It's a hands-on, delivery-focused role, and you'll make an impact from the start in risk management, security advisory, customer and tender responses, audit readiness and our data strategy.

This isn't a security engineering role. You won't configure firewalls or run vulnerability scans. Instead, you'll understand our technical environment well enough to spot risks and gaps, then recommend best practices for Engineering, DevOps and IT to put in place. A background in compliance management alone won't be enough for this role.

You'll report to our Senior Information Security Officer, who owns our GRC framework, ISO 27001 programme, CE/CE+ & DSPT compliance, and the security risk register. You'll help deliver across all of it.

Challenges you’ll solve...

• Own risk management: run risk sessions across the business, keep the risk register current, write clear risk reports and chase treatment actions to completion

• Advise the business: be the security voice with Engineering, DevOps, IT and Product, and a first point of contact for security questions from every team

• Handle customers, tenders and suppliers: answer security questionnaires and tenders accurately, and assess suppliers before we approve them

• Keep us audit-ready: gather evidence all year round for Cyber Essentials Plus, DSPT and ISO 27001, and flag control gaps with practical fixes

• Deliver our data strategy: drive the data classification and access control programmes forward with data owners

You should apply if...

• You have hands-on infosec and risk experience: ideally in health-tech, regulated SaaS or software development. You've run risk sessions, managed a risk register and reported on risk to senior stakeholders.

• You possess technical depth to hold your own: You understand authentication vs authorisation, least privilege, IAM, network segmentation and firewalls, patch and vulnerability management, endpoint protection and cloud infrastructure.

• You understand frameworks: ISO 27001, DSPT, NIST and Cyber Essentials Plus, and a sense of what proportionate looks like in a fast-moving product company.

• You work fast and independently: You manage your own workload, flag blockers early and can move between a tender, a questionnaire and an engineering conversation in the same day.

• You care about healthcare: and know the data we protect belongs to patients and clinicians.

Nice to have: enterprise risk management experience, and having been through a CE+ audit cycle.

What’s in it for you?

You’ll join a high-performing team on a mission to solve healthcare productivity, building a platform used by around 300k NHS staff every week, supporting the care of over 50 million NHS patients every year. We set a high bar, move fast, and give people the ownership and support to do the best work of their careers

• £65,000 - £75,000 salary, plus a discretionary recognition bonus for exceptional performance and impact, nominated by managers and awarded by our leadership team

• Equity: £15,000 in equal share options, so you share in the value you help create

• Benefits to suit you: adjust your healthcare cover, your pension or life insurance, whatever stage you're at in life

• Built for collaboration: We are an office-first culture and ask that you're in our (dog-friendly) Shoreditch office for a minimum of 3 days a week

• Close to our users: Regular hackathons, plus dedicated time to visit GP practices and other healthcare settings to see first‑hand how our products are used

• Time off: You'll get 28 days of holiday (plus bank holidays) and up to 4 weeks to work from anywhere per year

• Support at home: We offer enhanced parental leave, fertility support and parental loss support

• We have our very own chefs: Free healthy breakfasts, snacks and lunches, plus a weekly sweet treat