IT Security & Compliance (London, UK)

B Lab; United States; Teletrabalho; USD 76 000 - 93 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Remote-first workplace

Flexible work environment

Resumo da oferta

B Lab ищет специалиста по информационной безопасности на полную ставку для распределённой, удалённой команды. Ваша роль — проводить аудит и мониторинг угроз, обеспечивать соответствие регуляторам и поддерживать политику безопасности во всей сети.

У кандидата должны быть навыки в управлении доступом, incident response и взаимодействии с юридическим отделом для соблюдения требований по данным и непрерывности бизнеса.

Qualificações

• Опыт проведения аудита безопасности, оценки рисков и обзоров поставщиков.
• Знание одного признанного киберфреймворка.
• Опыт работы с соответствием данным и регуляторными нормами (GDPR, LGPD и т.п.).
• Опыт разработки или поддержки планов реагирования на инциденты и бизнес–процессов обеспечения непрерывности.

Responsabilidades

• Проводить регулярные аудит security аудиты и риск-оценки сетевых систем и приложений.
• Вести мониторинг и отчетность по кибербезопасности для руководства.
• Проводить внешние пентесты и контроль уязвимостей и координировать устранение.
• Разрабатывать и поддерживать политики доступа (MFA, SSO, минимальные привилегии).
• Сотрудничать с региональными IT-администраторами по защите рабочих станций и мобильных устройств.

Conhecimentos

Security audits

risk assessments

GRC

Google Workspace

Salesforce

KnowBe4

incident response

data protection

Ferramentas

Google Workspace

Salesforce

KnowBe4

endpoint management

Descrição da oferta de emprego

Описание

Please Note: B Lab is not working with a third party to fill this role an no part of our process requires applicants to pay fees. Applicants should only use our job board to submit an application, and will interact directly with our team during this process. This is a Full-Time Role (40 hours per week, 5DWW) with no option for part-time work. While this is a remote-first opportunity, the candidate filling this role must be a resident of the Netherlands or in the U.K. at the start of employment. Additionally, they must be within commuting distance of our office in Amsterdam or London. Please visit our Careers page to review all opportunities and submit your application for the role(s) that best fit your location and work authorization. This job ad will close automatically at 9:00AM EST on October 27th. The Technology & Data portfolio, provides the digital infrastructure, engineering and data capabilities that enable effective delivery, innovation and learning across the B Lab Global Network. It brings together four groups: Technology & Data Leadership, Product & Platform Engineering, Data & AI, and Infrastructure & Information Management. Infrastructure & Information Management (Operational Technology) is responsible for information security, workforce enablement and the adoption of digital tools across the network. It ensures resilience through secure, reliable infrastructure, and manages hosting, networks, access and incident response. The team is evolving from a function that supported a relatively uniform, single-organization tech stack of approximately 150 users into a globally coordinated department supporting approximately 500 users across a broad range of regions, time zones, languages, technical maturity levels and operational practices.

Задачи

• Conduct regular security audits and risk assessments of network systems, applications and processes, and maintain a prioritized risk register
• Establish and maintain a security baseline across the network, aligned to a recognized framework (for example ISO/IEC 27001:2022)
• Track and report security posture and maturity over time to the Technology leadership team, with clear metrics
• Run security reviews of new and existing vendors and technology platforms (third‑party risk), including SaaS tools used by regional and market teams
• Coordinate external penetration testing and vulnerability scanning, and track remediation with system owners
• Define and monitor access control standards (MFA, SSO, least privilege, joiner/mover/leaver processes) across core platforms such as Google Workspace and Salesforce
• Partner with Regional IT Administrators on endpoint and device security standards for a distributed, remote‑first workforce, moving toward a zero‑trust model
• Advise Product & Platform Engineering on secure‑by‑design practices for B Lab's digital security policy development and awareness
• Own and maintain the information security policy set (including the Information Security, Backup & Recovery and Security Incident Management policies) and the standards and procedures that support it
• Refine policies as the network consolidates, and communicate changes clearly to staff across regions and languages
• Own the network‑wide security awareness program (KnowBe4), including training, phishing simulations and completion reporting
• Contribute the security perspective to the B Lab AI Policy and to the safe adoption of AI tools
• Own and maintain the incident response plan, covering detection, escalation, containment, communication and post‑incident review
• Serve as lead coordinator during security incidents, working with Legal, Communications and affected regions
• Support business continuity and disaster recovery planning, including testing backup and recovery procedures
• Support data protection compliance across the regions where B Lab operates (for example GDPR, UK GDPR and Brazil's LGPD), in partnership with Legal and the Data Governance Lead
• Partner with Legal, HR, Finance and other teams on compliance matters, such as data processing agreements, data subject requests and breach notification
• Maintain documentation and evidence that supports audits, partner and funder due diligence, and regulatory inquiries

Требования

• 3+ years of experience in information security, IT governance, risk and compliance (GRC), or a closely related field
• Strong understanding of networking concepts, cybersecurity, and implementing best practices to ensure compliance with data and regulatory tech laws.
• Strong understanding of at least one recognized cybersecurity framework
• Experience conducting security audits, risk assessments and vendor security reviews
• Working knowledge of data protection regulations relevant to a global organization (for example GDPR, LGPD)
• Experience developing or maintaining incident response and business continuity plans
• Hands‑on familiarity with cloud and SaaS security, especially Google Workspace administration and identity and access management
• Ability to explain security risk in plain language to non‑technical colleagues, and to write clear policies
• Experience in a nonprofit, federated or multi‑entity organization, or in integrating security controls after a merger or consolidation
• Experience with Salesforce security, security awareness platforms (such as KnowBe4), or endpoint management tools
• Experience with Google Vault or similar eDiscovery and data retention tools
• Consider themselves a relentless problem solver, with a collaborative style and a systems‑thinking approach
• Be ready to take on growing challenges in a complex, global organization
• Have a positive outlook, and a consistent and positive manner working with others
• Have a strong desire to learn, improve and apply
• Know when to drive a workstream independently
• Know when to recommend outside resources, and how to advise leadership on technology and security strategy

Major objectives

Perform a network‑wide risk assessment: assess the security posture of B Lab and consolidating entities, identify gaps, and produce a prioritized risk register and roadmap. Establish and enforce a security baseline: using the assessment, define a clear baseline (identity, devices, data, vendors) and drive implementation with the Regional IT Administrators to close the highest‑priority gaps. Refresh the policy set: review and update the information security policies so they apply to the consolidated network, and get them approved and communicated. Build a security awareness and incident response culture: take ownership of KnowBe4, run training and phishing simulations, and publish an incident response plan so staff know how to report threats and the technology team has a defined remediation process.

Conditions

• An annual salary in the range of £57,100 - £70,000 based on skills and experience
• In your first year, you’ll start with 20 vacation days in addition to national & bank holidays; this increases to 25 days after your third anniversary
• Additional time off during org‑wide closures when the entire organization is closed (not including holidays)
• After your first year of employment - paid time off for community service, 40 hours of paid time off for professional development, and a professional development budget (we assess this PD budget annually)
• Additional floating holidays and personal days (prorated to start date)
• Medical and dental supplemental insurance for the employee through BUPA
• Life insurance benefit
• Income protection insurance
• Statutory pension
• Global travel insurance
• A remote‑first workplace
• A flexible work environment with the ability to plan your work week around your personal commitments
• This is a Full-Time Role (40 hours per week, 5DWW) with no option for part-time work.
• This job ad is for our London, UK hub. While this is a remote‑first opportunity, the candidate filling this role must hold work authorization to work in the Netherlands without any time limitations or any other restrictions, and they must be a resident of the U.K. at the start of employment. Additionally, they must be within commuting distance of our office in London. This role is not eligible to be remote from other countries in Europe.

Our ideal start date for this role is December 1, 2026.

About B Lab

B Lab™ is the nonprofit behind Certified B Corporations™, a community of businesses that meet verified social, environmental, and governance standards. Together, our movement is working towards a more inclusive, equitable, and fair economic system. Our history B Lab began in 2006 with the idea that a different kind of economy was not only possible — it was necessary. Our founders Andrew Kassoy, Bart Houlahan, and Jay Coen Gilbert believed there was a better way to do business: better for workers, better for communities, and better for the planet. When our movement’s first 81 Founding B Corps signed the Declaration of Interdependence in 2007, they were not just proposing a better way of doing business. They were proposing a different definition altogether. What we’ve achieved B Lab became known for certifying B Corporations™, companies that meet verified standards of social and environmental performance, accountability, and transparency. But we do much more than that. We help mobilize a global community of businesses committed to collective action on society’s most critical challenges. In 2010, B Lab was part of successfully drafting and passing benefit corporation in Maryland, the first U.S. state to do so. This created a legal framework that allows companies to keep their values of care and community, not just shareholder value, at the forefront. Today, benefit corporation legislation is active in 52 jurisdictions around the world.

Future

In 2024, leaders from across the network agreed to evolve into a more integrated organization that embodies interdependence. This next iteration of our global network will balance global coherence with local agency to achieve our vision of economic systems change. We are now building this future together.