InfoSec Lead

orbital; Greater London; On-site; GBP 120,000 - 170,000; Full time

Job summary

Orbital is seeking a senior London-based InfoSec Lead to own information security due diligence, compliance, and vendor risk end-to-end. You will focus on automating DDQs, strengthening our compliance posture, and securing the Infosec function to enable growth.

This is a full-time role reporting alongside our IT Manager. You'll work with Engineering, Product and Legal to ensure security is embedded in how we build and sell, not bolted on later, and you will manage external Infosec support while

Qualifications

• Senior in-house or scale-up InfoSec leadership experience.
• Experience owning due diligence, vendor review and compliance end-to-end.
• Strong understanding of cloud security and IT security fundamentals.

Responsibilities

• Own InfoSec strategy and roadmap, scaling security with the business.
• Run risk identification, assessment and remediation; maintain risk register.
• Lead third-party risk assurance and DDQs for customers and vendors.
• Automate DDQs and manage certification programs (ISO 27001, SOC 2 Type 2).
• Collaborate with Engineering, Product and Legal to embed security requirements.

Skills

InfoSec leadership

Vendor risk management

Cloud security

Risk assessment

Tools

ISO 27001

SOC 2

ISMS

Job description

Orbital is the AI platform for real estate legal work.

Real estate shapes the world around us: our homes, our workplaces and our cultural landmarks. It's the infrastructure that powers everyday life and is the world's largest asset class. Yet behind every single deal, real estate and legal teams work hard to navigate decades-old complexity; manually connecting documents, hidden obligations, geo-spatial context, and multiple parties into a path forward. We connect the legal and physical record, so that path is clearer than ever before. Our mission is to make real estate transactions faster, clearer, and less manual.

Here, you'll be part of changing how the deals behind the largest asset class get transacted, and will help shape the future of real estate.

A bit about us:

We're building at the forefront of AI technology, without losing the deeply human expertise our clients depend on.

Orbital is built with former practising real estate lawyers and 250+ years of combined legal expertise. We're purpose-built for the complexity of real estate: accelerating due diligence, drafting and negotiation, and deal coordination with legal-grade precision.

We've just raised a $60m Series B, led by Brighton Park Capital, to accelerate our global expansion - $75m raised to date.

We're trusted by 5,000+ real estate professionals, spanning UK Magic Circle and US Am Law 100 firms, to household names like M&S. Leading firms like BCLP, Orrick, Goodwin, Womble Bond Dickinson and Clifford Chance rely on Orbital to remove the busywork, freeing legal and real estate teams to focus on sharp judgment, standout client service, and closing deals faster.

Working at Orbital means joining a bold, ambitious team, with the trust to take ownership and make a real impact from day one.

The Role

Orbital has been scaling fast, and we're scaling or security and compliance with it. We're hiring a senior, London-based InfoSec Lead to own our information security due diligence, compliance, and vendor risk end-to-end - bringing structure and consistency to work that's currently covered on a contractor basis.

Now is the time to bring this function in-house, focusing on automating manual tasks (such as customer DDQs), enhancing our compliance stance, and ultimately securing the Infosec function as a proactive enabler of our growth.

This is a full-time InfoSec role, working alongside our IT Manager. Whilst experience in IT operations or IT management is helpful, the Infosec Lead and IT Manager report independently to our Head of Operations and own separate (but naturally interconnected) remits.

You'll also work closely with Engineering, Product, Legal and our external Infosec support, to keep security and compliance embedded in how the business runs, not bolted on after the fact.

What You'll Own

InfoSec & Compliance Delivery

You will:

• Own our InfoSec strategy and roadmap : set the direction for how security and compliance scale with the business, not just an executor; identify control gaps and weaknesses, prioritize remediation, and track it through to completion.
• Own our risk program : run risk identification, assessment and treatment, keep the risk register current. You're making the call on what's an acceptable risk.
• Own third party risk assurance, in both directions : run vendor security reviews for vendors we bring on (or are renewing with) and own customer & vendor due diligence (DDQs) when we're the ones being assessed.
• Pull in support required from the rest of the business and jump on client calls when needed to resolve DDQs.
• Drive automation on the DDQ side specifically, so it doesn't eat a disproportionate share of your time as the function matures.
• Own our existing and future compliance certifications: you'll be responsible for maintaining compliance with existing standards (ISO 27001 and SOC2 Type 2) and pursuing future certifications relevant to us. Management of the compliance program will be end-to-end, and involve ISMS management reviews, quarterly access control reviews, audit evidence gathering, scheduling and remediation tracking.
• This also includes keeping policy & public-facing security documentation (eg. our trust centre) current - so certification is a continuously-run capability rather than a periodic scramble.
• Partner cross-functionally : work with Engineering, Product, and Legal to embed security and compliance requirements into how we build and sell, and stay close enough to product changes that customer-facing security information is always accurate.

What We're Looking For

Significant senior in-house or scale-up InfoSec leadership experience : you've owned due diligence, vendor review, and compliance work end-to-end inside a fast-moving business, not just advised from the outside.

Strong understanding of cloud & cloud security, and ideally previous technical background in IT Security or SWE / DevOps.

A track record of scaling due-diligence processes , not just running them manually, you know h