VP Information Security

Era4; Greater London; On-site; GBP 150,000 - 230,000; Full time

Job summary

Era4 is seeking a VP, Information Security to lead the security program across its AI infrastructure in the UK. You will oversee risk, governance and incident response while partnering with CTO, COO and Site Operations to scale security for multiple production sites and OT networks.

The role demands hands-on security leadership, executive communication, and a track record in operating secure AI/datacentre infrastructure, with awareness of sovereign AI and regulatory readiness.

Qualifications

• Experience with SOC 2 Type I/II and cyber security certifications.
• Knowledge of NCSC Cyber Assessment Framework and CREST testing.
• Understanding UK data protection and sovereign AI considerations.
• Ability to translate security risk into business decisions.

Responsibilities

• Lead the InfoSec group (Head of InfoSec, security engineers, DevSecOps) and grow it into detection and response, threat intel, and GRC.
• Own internal and external security risk, governance and metrics, reporting monthly to the executive team.
• Build scalable security operating model, tooling and processes, including MDR for after-hours.
• Embed secure-by-design practices through threat assessments and design reviews with engineering.
• Own security architecture for AI/HPC platforms, including GPU infrastructure and Kubernetes.
• Set tenant isolation standards for multi-tenant and bare metal GPU, firmware and BMC security.
• Lead cloud, network, identity and platform security on zero-trust principles.
• Oversee monitoring, incident response and key management, and ensure vendor SLAs.
• Set security policy for OT networks run by Site Operations.
• Own hardware, supply chain and third-party security for silicon vendors and deployment partners.
• Maintain cyber-risk framework and risk registers; manage certification programs.
• Engage customers and regulators on security terms and risk.

Job description

Era4 develops, owns and operates AI infrastructure across the UK, powered by renewable energy. Converting legacy industrial and energy sites into modern data-centre facilities, Era4 is combining brownfield regeneration opportunities with cleaner, efficient, scalable compute capacity for healthcare, research, finance, enterprise, and public-sector organisations.

Era4 runs production GPU capacity today and is building much larger sites through 2027 and 2028, connected by its own dark-fibre backbone and redundant production control planes.

Role Summary:

The VP, Information Security leads Era4's Information Security group and is accountable for internal and external security risk across Era4's IT estate: platform, network, compute, storage, and the services Era4 delivers to customers. The role also sets security policy for the operational technology networks that Site Operations runs.

The role takes over from an interim fractional CISO in early 2027 and leads security through the build and go-live of Era4's next production sites. It serves as the beachhead for a security function that will grow well beyond its initial team as the business scales.

For an exceptional candidate, this role may be upleveled to Chief Information Security Officer (CISO), with scope and accountability to match.

Reporting to the CTO, and partnering closely with the COO's Site Operations, DC Design, BizOps and GRC teams, the role combines hands‑on operational execution with senior, customer‑facing credibility, supporting Era4's sovereign and sustainable AI mission.

Key Responsibilities:

Security leadership and execution:

• Lead the Information Security group (Head of InfoSec, security engineers, DevSecOps) and grow it into detection and response, threat intelligence, application security and GRC as the business scales.
• Own internal and external security risk, governance and metrics, reporting monthly to the executive team.
• Build a scalable security operating model, tooling and processes, including managed detection and response for out-of-hours cover.
• Embed secure‑by‑design practices through threat assessments and design reviews with engineering teams.

Infrastructure, platform, and data security:

• Own security architecture for AI and HPC platforms, including GPU infrastructure, Kubernetes, orchestration and the inter‑site dark‑fibre backbone.
• Set tenant isolation standards for multi‑tenant and bare metal GPU, covering NVIDIA and AMD firmware and BMC security, node sanitisation and the provider/customer responsibility boundary.
• Lead cloud, network, identity and platform security on zero‑trust principles, including data‑centric and sovereignty controls.
• Oversee monitoring, detection, incident response and key management, holding providers to contractual SLAs.
• Set security policy for OT networks run by Site Operations, keeping them segmented from IT under one incident process.
• Own hardware, supply chain and third‑party security for silicon vendors, integrators and deployment partners, and support corporate IT security.

Risk, compliance, and assurance:

• Maintain the cyber‑risk framework, threat models and risk registers with the COO's GRC function.
• Own the certification programme, starting with Cyber Essentials Plus and SOC 2 Type I and Type II, and adding accreditations as customers require them.
• Align controls with the NCSC Cyber Assessment Framework and run regular CREST‑accredited penetration testing.
• Ensure compliance with UK data protection, sovereign AI expectations and incoming UK cyber resilience regulation for data centres.
• Act as the accountable executive for security incidents.

Customer, strategy, and culture:

• Lead customer security engagement, including questionnaires, assurance requests and contractual security terms.
• Act as the senior security authority with customers, partners and regulators, and advise the CTO and COO on risk and trade‑offs.
• Shape the future security organisation and build a pragmatic security culture.

What Success Looks Like in the First 12 Months

• A clean handover from the interim fractional CISO, with the monthly security risk report owned and trusted by the executive team.
• Security sign-off for the next production site before go‑live, covering threat models, design reviews and an incident response tabletop.
• Cyber Essentials Plus certification within the first three months.
• A SOC 2 Type I report within six months, with the Type II observation window under way.
• A SOC 2 Type II report within 12 months, with customer assurance material ready for enterprise sales.
• Tenant isolation, firmware and BMC standards enforced across production sites, including new sites before customer workloads go live.
• Managed detection and response operating against agreed SLAs, and one incident process across IT and OT tested with Site Operations.
• Third‑party security risk managed for silicon vendors, integrators and deployment partners .
• A regulatory readiness assessment presented to the executive team, and a plan for the next phase of the security organisation .
• Senior security leadership in private‑sector, high‑growth companies, ideally AI‑native businesses, neoclouds or GPU cloud providers, or data centre and digital infrastructure operators. Experience with cloud providers or high‑tech product companies is also relevant.
• Has implemented the initial security operating foundation at a start‑up or scale‑up and grown it as the business scaled.
• Proven ownership of security architecture and operations across cloud, network, identity, and compute, using secure‑by‑design and zero‑trust architectures.
• Experience securing AI, HPC, GPU, or large‑scale compute infrastructure where customers have privileged access, including tenant isolation, firmware and BMC security, and shared responsibility boundaries.
• Strong grounding in monitoring and incident response, including managing an outsourced SOC or MDR provider and leading live incidents through to customer communication.
• Able to translate security risk into clear business decisions and report it at executive level.
• Comfortable operating with a small team, growing it, and representing security externally.
• Has led SOC 2 Type II or equivalent security certification, ideally on an accelerated timeline, including in regulated environments, and supported enterprise sales through customer due diligence and audits.
• Has set security policy for OT networks in data centres or critical facilities, working with the site operations teams that run power, cooling, building management and physical access.
• Private‑sector experience in critical‑infrastructure or sovereign AI contexts.
• Exposure to sustainability‑led technology or energy‑aware infrastructure.
• Eligible for UK Security Check (SC) clearance.

Personal attributes:

• Accountable, pragmatic, and delivery focused.
• Hands‑on leader with strong technical credibility.
• Trusted partner to executives, customers, and regulators.
• High integrity and aligned with Era4’s sovereign and sustainable AI mission.

Why Join Era4:

You'll be joining a mission‑driven, high‑growth start‑up building critical national infrastructure, where operational excellence directly enables growth. This role offers high visibility with leadership, real autonomy, and the chance to build a security function from a small, capable team into one that matches the scale of the business.

Diversity & Inclusion :

Era4 is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.