Director of Information Security

Location: Hybrid London or Midlands Start Date: ASAP

The Opportunity An established and rapidly growing software organisation is seeking an experienced Director of Information Security to lead and mature its security function during a critical growth phase. This is a hands-on leadership role requiring a pragmatic security professional who can balance risk management, regulatory compliance, technology innovation, and business enablement. You will work closely with senior leadership to develop and execute a group-wide security strategy whilst ensuring security remains embedded throughout the organisation. The successful contractor will be comfortable operating at both strategic and operational levels, engaging with board-level stakeholders while also driving technical security initiatives across infrastructure, applications, data, people, and processes.

Key Responsibilities

Define and deliver the organisation's information security strategy and roadmap. Partner with business leaders to ensure security supports growth, transformation, and operational objectives. Develop and maintain a robust security framework incorporating industry best practices and a defence-in-depth approach. Drive organisation-wide security awareness, training, and human risk management initiatives. Lead identity and access management, endpoint security, and device governance programmes. Oversee application security, secure software development practices, vulnerability management, code scanning, and penetration testing activities. Support cloud security initiatives across multi-cloud environments using native security tooling and monitoring capabilities. Establish and enhance incident response processes, including playbooks, communications plans, and breach readiness procedures. Manage third-party supplier security assessments and vendor risk programmes. Ensure compliance with relevant regulatory and data protection requirements, including GDPR and emerging regulatory frameworks. Maintain and develop security governance, policies, controls, and audit readiness. Lead and support security certification programmes, including ISO 27001 and Cyber Essentials Plus. Provide guidance around the governance, adoption, and secure use of emerging technologies, including artificial intelligence. Support acquisition integration activities from a security due diligence and risk management perspective. Present risk, compliance, and security updates to executive leadership and key stakeholders.Required Experience Proven experience in a senior Information Security leadership role, ideally Director, Head of Information Security, or CISO level. Strong understanding of security governance, risk management, compliance, and operational security. Experience leading security programmes within software, SaaS, technology, or product-led organisations. Expertise across application security, infrastructure security, cloud security, and information governance. Experience delivering and maintaining frameworks such as ISO 27001, Cyber Essentials Plus, NIST CSF, or similar. Strong knowledge of vulnerability management, security operations, incident response, and vendor risk management. Experience engaging with executive leadership and boards on security matters. Knowledge of M&A security reviews and post-acquisition integration is highly desirable. Excellent communication skills with the ability to influence both technical and non-technical stakeholders.Desirable Skills Experience within regulated environments. Familiarity with AWS and/or Azure security services. Exposure to DORA, NIS2, and related regulatory frameworks. Security certifications such as CISSP, CISM, CRISC, or equivalent