IT Security Officer

We’re looking for an IT Security Officer to take genuine first-line ownership of security across a UK-regulated business. You’ll be the person who makes security real - not the team that writes the policies, but the one who implements them, tests them, and fixes what’s broken.

What makes this different

You’ll work across the full security lifecycle. One week you might be running a VAPT or interrogating vulnerability scan data; the next you’re advising on a major project with IS implications or presenting risk findings to senior stakeholders. The breadth is genuine - and so is the accountability.

You’ll also have the backing of a well-resourced Group security function, which means established frameworks, a peer network, and Group-wide norms to work within - without being swallowed by a huge central IT machine. The local business is yours to protect.

Who you are

You’re a cybersecurity professional who’s moved beyond the basics. You understand how risk lives in an organisation - not just in the firewall, but in processes, people, and third-party relationships. You’re as comfortable writing a risk treatment plan as you are with a vulnerability scanner. And you know how to communicate security to people who don’t speak the language.

Concretely, you’ll bring:

• A solid grounding in cybersecurity fundamentals - network security, vulnerability management, incident response, access controls
• Experience assessing and treating IT risk, ideally within a regulated environment
• Hands-on familiarity with security tooling (endpoint monitoring, vulnerability scanning - Tenable experience is a plus)
• The ability to design and land security measures that actually stick
• Strong enough communication skills to influence without authority
• Recent and relevant experience in Financial services is a must

The opportunity

This is a role for someone who wants to build something, not just maintain it. The business is growing, the threat landscape is evolving, and there’s real work to be done. If you want to help own a security function rather than feed into someone else's, this is worth a conversation.

You’re a cybersecurity professional who’s moved beyond the basics. You understand how risk lives in an organisation - not just in the firewall, but in processes, people, and third-party relationships. You’re as comfortable writing a risk treatment plan as you are with a vulnerability scanner. And you know how to communicate security to people who don’t speak the language.

Concretely, you’ll bring:

• A solid grounding in cybersecurity fundamentals - network security, vulnerability management, incident response, access controls
• Experience assessing and treating IT risk, ideally within a regulated environment
• Hands-on familiarity with security tooling (endpoint monitoring, vulnerability scanning - Tenable experience is a plus)
• The ability to design and land security measures that actually stick
• Strong enough communication skills to influence without authority
• Recent and relevant experience in Financial services is a must