Security & Assurance Lead: Build Cloud Security & GRC

Harvey Nash Group; City of Edinburgh; Hybrid; GBP 70,000 - 80,000; Full time

Benefits offered by this job

Hybrid working

Two days in Edinburgh office per week

30 days annual leave + birthday off

Enhanced parental leave

Company pension with employer contrib.

Learning & development budget

Opportunity to work directly with CTO

Job summary

Harvey Nash is partnering with a fast-growing technology business delivering critical digital infrastructure to the UK public sector to recruit a Security & Assurance Lead in Edinburgh. This role blends hands-on cloud security engineering with governance, risk and compliance, working directly with the CTO to shape security as the business grows.

Hybrid working with two days in the Edinburgh office, ownership of security strategy, ISO 27001 and Cyber Essentials Plus, vulnerability management,

Qualifications

• Hands-on cybersecurity engineering experience, ideally in AWS.
• Experience implementing ISO 27001 and Cyber Essentials Plus.
• Practical experience in vulnerability management and threat modelling.
• Ability to communicate security risks clearly to senior stakeholders.

Responsibilities

• Take ownership of the organisation's cybersecurity function, security strategy, policies and controls.
• Lead ISO 27001 and Cyber Essentials Plus certification and ongoing compliance activities.
• Oversee cloud security across an AWS-based serverless environment.
• Manage vulnerability assessments, penetration testing and remediation activities.
• Embed security into development pipelines, including SAST, dependency scanning and secrets management.
• Conduct threat modelling and security risk assessments for new applications, features and integrations.
• Lead security incident response, detection engineering and security monitoring activities.
• Develop and maintain security documentation, risk registers, security playbooks and assurance reporting.
• Work closely with government cybersecurity stakeholders to demonstrate compliance and security assurance.
• Implement AI-assisted security automation to improve monitoring, vulnerability management and compliance evidence gathering.
• Oversee access governance, security awareness and data protection activities.

Skills

Cybersecurity engineering

ISO 27001

Cyber Essentials Plus

DevSecOps

Threat modelling

Vulnerability management

AWS cloud

Security policies & governance

Risk communication

AI-driven security automation

Job description

Harvey Nash is partnering with a fast-growing technology business delivering critical digital infrastructure to the UK public sector to recruit a Security & Assurance Lead in Edinburgh. This role blends hands-on cloud security engineering with governance, risk and compliance, working directly with the CTO to shape security as the business grows.

Hybrid working with two days in the Edinburgh office, ownership of security strategy, ISO 27001 and Cyber Essentials Plus, vulnerability management,