Security & Privacy Lead

Scarlet; Greater London; On-site; GBP 90,000 - 140,000; Full time

Job summary

Scarlet is seeking a Security & Privacy Lead to own the ISO 27001 ISMS and GDPR data privacy programme, ensuring scalable, secure practices as the company grows. You will work closely with engineering to identify risks early, deploy controls, and shape AI tooling adoption with security by design, maintaining high standards without slowing progress.

This is a hands-on leadership role in a fast-growing certification-focused environment where clear technical communication with non-technical

Qualifications

• Experience owning an ISMS through ISO 27001 certification or surveillance audits.
• Experience running a GDPR compliance programme.
• Hands-on with implementing security controls yourself, not only advising others.
• Proven ability to scale a compliance program as volume grows.
• Experience assessing third-party security and privacy risks.
• Experience collaborating with engineers on threat models and remediation.
• Ability to explain technical trade-offs to non-technical colleagues and customers.

Responsibilities

• Own and improve Scarlet's ISO 27001-certified ISMS.
• Own and improve Scarlet's GDPR-compliant data privacy programme.
• Implement and maintain controls hands-on.
• Perform information security and data privacy risk assessments for vendors and AI tools.
• Build an internal ecosystem of AI tools that is secure by design.
• Lead threat modelling with engineers and drive penetration-test findings to resolution.
• Represent Scarlet's security and privacy to customers.
• Monitor systems to spot vulnerabilities with practical consequences.

Skills

ISMS ownership

GDPR compliance

Security controls

Threat modelling

Vendor risk

Audits & attestations

Technical communication

Job description

We pull medical technology from the future to solve human health.

Scarlet is authorised to assess and certify medical devices. We combine clinical, technical and regulatory expertise with AI agents and software so rigorous certification can keep pace with product development at the world’s most ambitious technology companies, without lowering the safety bar.

Our customers have cut a year or more from their certification timelines for new AI-enabled medical devices and shortened product-update cycles from months to weeks. You’ll join a team building the infrastructure that makes these outcomes repeatable at scale.

About the role

As Scarlet's first Security & Privacy Lead, you will own how we protect the information our customers trust us with. They share highly sensitive data with us, and keeping it safe is one of our most important responsibilities. Scarlet is growing fast, and our security and privacy programme has to keep up the pace.

You will own our ISO 27001-certified information security management system and our data privacy programme, and make them scale as we grow. You will work closely with engineering to find and fix risks early, and with teammates across Scarlet so that everyone, from new joiners to contractors, has a secure environment that works for them.

You will also shape how Scarlet adopts AI tools safely, assessing the threat vectors of new tools and helping build an internal ecosystem of AI tools that is secure by design.

As a certification body, we hold ourselves to high standards for information security and data privacy. Your work will help us meet them without slowing anyone down.

Responsibilities

• Own and improve Scarlet's ISO 27001-certified ISMS.

• Own and improve Scarlet's GDPR-compliant data privacy programme.

• Be hands-on with implementing and maintaining controls.

• Perform information security and data privacy risk assessments for vendors and AI tools.

• Help build Scarlet's internal ecosystem of AI tools, so that it is secure by design and lets colleagues use AI freely and safely.

• Lead threat modelling with our engineers, commission external penetration tests and drive their findings to resolution.

• Represent Scarlet's security and privacy to customers.

• Proactively monitor our systems and operations to spot real vulnerabilities with practical consequences.

Required qualifications

• Experience owning an ISMS through ISO 27001 certification or surveillance audits.

• Experience running a GDPR compliance programme.

• A track record of being hands-on, implementing security controls yourself, not only advising others on them.

• Evidence of building a programme that scales. You've turned recurring compliance work, such as policy reviews, evidence collection or security questionnaires, into a repeatable process that handles growing volume without a matching increase in manual work.

• Experience assessing the information security and data privacy risks of third-party services.

• Experience working with engineers on threat models and penetration test remediation, with the technical judgement to read an architecture and challenge it.

• Experience explaining technical trade-offs clearly to non-technical colleagues and customers.

Preferred qualifications

• Experience working in a highly regulated environment, such as medical devices or conformity assessment.

• Experience with SOC 2 or other security attestations.

• Knowledge of AI regulation and standards, such as the EU AI Act or ISO 42001.

• Experience administering or securing AI platforms or agent tooling in a business setting.

• Experience automating compliance work.

The interview process

1. Intro chat with Niclas - 30 min (remote)

2. Compliance knowledge chat with Tom - 30 min (remote)

3. Technical knowledge chat with Alan - 30 min (remote)

4. Case with Niclas - 45 min (remote)

5. Culture fit chats with James & Jamie - 20 min each (onsite)