InfoSec Lead

Academic Key; Greater London; On-site; GBP 120,000 - 180,000; Full time

Job summary

Orbital is seeking a senior InfoSec Lead in London to own information security due diligence, compliance, and vendor risk end-to-end. The role focuses on automating mundane tasks, improving the compliance stance, and embedding security across product and operations.

This is a full-time, on-site position reporting to the Head of Operations. You will collaborate with Engineering, Product, Legal and external Infosec partners to ensure security is integrated into every business process and customer

Qualifications

• Significant senior in-house or scale-up InfoSec leadership experience.
• Strong understanding of cloud security and IT security practices.
• Proven track record in due diligence, vendor reviews and compliance work.

Responsibilities

• Own InfoSec strategy and roadmap and scale security with the business.
• Manage risk program including risk identification, assessment and treatment.
• Lead third-party risk assurance and vendor due diligence.
• Drive automation of DDQ processes to improve efficiency.
• Maintain certifications (ISO 27001, SOC 2 Type 2) and manage audits.

Skills

InfoSec leadership

Vendor risk management

Compliance management

Automation

Education

Experience or degree in IT security / cybersecurity

Tools

ISO 27001

SOC 2 Type 2

DDQ automation

Job description

InfoSec Lead

Orbital · London

Abroad London Full Time Link validated

Orbital is the AI platform for real estate legal work. Real estate shapes the world around us: our homes, our workplaces and our cultural landmarks. It’s the infrastructure that powers everyday life and is the world's largest asset class. Yet behind every single deal, real estate and legal teams work hard to navigate decades-old complexity; manually connecting documents, hidden obligations, geo-spatial context, and multiple parties into a path forward. We connect the legal and physical record, so that path is clearer than ever before. Our mission is to make real estate transactions faster, clearer, and less manual. Here, you'll be part of changing how the deals behind the largest asset class get transacted, and will help shape the future of real estate. A bit about us: We’re building at the forefront of AI technology, without losing the deeply human expertise our clients depend on. Orbital is built with former practising real estate lawyers and 250+ years of combined legal expertise. We're purpose-built for the complexity of real estate: accelerating due diligence, drafting and negotiation, and deal coordination with legal-grade precision. We've just raised a $60m Series B, led by Brighton Park Capital, to accelerate our global expansion – $75m raised to date. We're trusted by 5,000+ real estate professionals, spanning UK Magic Circle and US Am Law 100 firms, to household names like M&S. Leading firms like BCLP, Orrick, Goodwin, Womble Bond Dickinson and Clifford Chance rely on Orbital to remove the busywork, freeing legal and real estate teams to focus on sharp judgment, standout client service, and closing deals faster. Working at Orbital means joining a bold, ambitious team, with the trust to take ownership and make a real impact from day one. The Role Orbital has been scaling fast, and we’re scaling or security and compliance with it. We're hiring a senior, London-based InfoSec Lead to own our information security due diligence, compliance, and vendor risk end-to-end - bringing structure and consistency to work that's currently covered on a contractor basis. Now is the time to bring this function in-house, focusing on automating manual tasks (such as customer DDQs), enhancing our compliance stance, and ultimately securing the Infosec function as a proactive enabler of our growth. This is a full-time InfoSec role, working alongside our IT Manager. Whilst experience in IT operations or IT management is helpful, the Infosec Lead and IT Manager report independently to our Head of Operations and own separate (but naturally interconnected) remits. You’ll also work closely with Engineering, Product, Legal and our external Infosec support, to keep security and compliance embedded in how the business runs, not bolted on after the fact. What You'll Own InfoSec & Compliance Delivery You will: Own our InfoSec strategy and roadmap : set the direction for how security and compliance scale with the business, not just an executor; identify control gaps and weaknesses, prioritize remediation, and track it through to completion. Own our risk program : run risk identification, assessment and treatment, keep the risk register current. You're making the call on what's an acceptable risk. Own third party risk assurance, in both directions : run vendor security reviews for vendors we bring on (or are renewing with) and own customer & vendor due diligence (DDQs) when we’re the ones being assessed. Pull in support required from the rest of the business and jump on client calls when needed to resolve DDQs. Drive automation on the DDQ side specifically, so it doesn’t eat a disproportionate share of your time as the function matures. Own our existing and future compliance certifications: you’ll be responsible for maintaining compliance with existing standards (ISO 27001 and SOC2 Type 2) and pursuing future certifications relevant to us. Management of the compliance program will be end-to-end, and involve ISMS management reviews, quarterly access control reviews, audit evidence gathering, scheduling and remediation tracking. This also includes keeping policy & public-facing security documentation (eg. our trust centre) current - so certification is a continuously-run capability rather than a periodic scramble. Partner cross-functionally : work with Engineering, Product, and Legal to embed security and compliance requirements into how we build and sell, and stay close enough to product changes that customer-facing security information is always accurate. What We're Looking For Significant senior in-house or scale-up InfoSec leadership experience : you've owned due diligence, vendor review, and compliance work end-to-end inside a fast-moving business, not just advised from the outside. Strong understanding of cloud & cloud security, and ideally previous technical background in IT Security or SWE / DevOps. A track record of scaling due-diligence processes , not just running them manually, you know how to spot what can be tem

Academic Key will never request login credentials or application fees for this role.