Information Security & ISMS Specialist

GCS Recruitment; United States; Remote; USD 89,000 - 123,000; Full time

Job summary

GCS Recruitment is seeking a hands-on Information Security & ISMS Specialist to drive and mature our security, compliance, and risk management practices, with a focus on ISO 27001 controls and continuous improvement.

You will collaborate with Engineering, DevOps, IT, Data Governance, and AI Governance to embed security into day-to-day operations while maintaining audit readiness in a fast-growing, fully remote role across the UK and Ireland.

Qualifications

• 5+ years in information security, ISMS, Governance, Risk & Compliance, or related roles.
• Hands-on experience managing or supporting an ISO 27001 environment.
• Experience supporting internal and external audits.
• Strong understanding of risk management and security governance.
• Excellent stakeholder management and communication skills.

Responsibilities

• Support ongoing management and improvement of the ISO 27001 ISMS.
• Prepare for and support internal, external, customer, and certification audits.
• Maintain security policies, procedures, risk registers, and control frameworks.
• Identify control gaps and drive corrective actions through to completion.
• Conduct vendor and customer security assessments and due diligence activities.
• Ensure evidence is gathered, maintained, and audit-ready.
• Verify security controls independently, including MFA, RBAC, EDR, SIEM, and vulnerability management controls.
• Support business continuity, resilience, and tabletop exercises.
• Deliver engaging security awareness initiatives and promote a strong security culture.
• Work with stakeholders across the business to implement practical, risk-based security solutions.
• Monitor regulatory and compliance requirements, including ISO 27001, GDPR, AI governance, and healthcare standards.

Skills

ISMS

Risk management

Audit support

Cloud security

Stakeholder mgmt

Security governance

Security controls

Job description

Information Security & ISMS Specialist

The Role

We're looking for a hands‑on Information Security & ISMS Specialist to help drive and mature our security, compliance, and risk management practices.

Working closely with the Information Security Lead and cross‑functional teams including Engineering, DevOps, IT, Data Governance, and AI Governance, you'll play a key role in maintaining and improving our ISO 27001-certified Information Security Management System (ISMS).

This is not a traditional tick‑box GRC role. We're looking for someone who takes ownership, validates controls firsthand, drives continuous improvement, and helps embed security into the day‑to‑day operation of the business.

This is a fully remote within the UK or Ireland. Applicants must already have the right to work in the UK or Ireland. Visa sponsorship is not available.

Key Responsibilities

• Support the ongoing management and improvement of the ISO 27001 ISMS.
• Prepare for and support internal, external, customer, and certification audits.
• Maintain security policies, procedures, risk registers, and control frameworks.
• Identify control gaps and drive corrective actions through to completion.
• Conduct vendor and customer security assessments and due diligence activities.
• Ensure evidence is gathered, maintained, and audit‑ready.
• Verify security controls independently, including MFA, RBAC, EDR, SIEM, and vulnerability management controls.
• Support business continuity, resilience, and tabletop exercises.
• Deliver engaging security awareness initiatives and promote a strong security culture.
• Work with stakeholders across the business to implement practical, risk‑based security solutions.
• Monitor relevant regulatory and compliance requirements, including ISO 27001, GDPR, AI governance, and healthcare‑related standards.

Must‑Have Experience

• 5+ years' experience in Information Security, ISMS, Governance, Risk & Compliance, or related security roles.
• Hands‑on experience managing or supporting an ISO 27001-certified environment.
• Experience supporting both internal and external audits.
• Strong understanding of risk management and security governance.
• Excellent stakeholder management and communication skills.
• Ability to translate technical security requirements into practical business actions.
• Experience working with cloud‑based environments and modern security controls.
• Comfortable operating in a fast‑paced, high‑growth environment with a high degree of autonomy.

Nice to Have

• CISSP or equivalent certification.
• Experience with SOC 2, CIS Controls, ISO 27701, or similar frameworks.
• Technical background with security control implementation experience.
• Experience partnering closely with engineering and product teams.