> Markdown version of [/jobs/ext/4642276-head-of-information-and-cyber-security](https://www.wearedevelopers.com/jobs/ext/4642276-head-of-information-and-cyber-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Head of Information and Cyber Security - **Company:** Onodrim Industries - **Location:** London, United Kingdom - **Experience:** Expert - **Salary:** £73,213 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Software as a Service, Cloud Computing Security, Cloud Engineering, Cyber Security, Network Segmentation, Office Suite, Remote Access Technology, Process Control Systems - **Published:** November 9, 2026 - **Apply:** https://www.adzuna.co.uk/jobs/details/5958941889 ## About the Role * 5+ years in information security, with at least 2 in a role where you owned the programme - Head of Security, CISO or deputy at a company of similar or larger scale, or equivalent responsibility in government, military or a defence contractor. * Deep hands-on experience with a modern cloud-native stack: an enterprise identity provider, Apple and Windows endpoint management, cloud productivity-suite administration, and SaaS security. * Experience securing on-premise and industrial environments - Windows domains, legacy ERP, shop-floor networks, OT/ICS - not only cloud. * A track record of leading incident response, including at least one serious incident you can talk through end to end. * Working knowledge of the European regulatory landscape for defence and critical industry: NIS2, ISO 27001, GDPR, export control (EU dual-use, ITAR/EAR) and national classified-information regimes. * Experience taking a company through ISO 27001 or an equivalent certification from scratch. * Comfort with corporate IT: you have run or managed device fleets, SaaS administration and onboarding, and are willing to do it yourself at a small company. * Strong judgement on build vs. buy vs. outsource - you know when to run it yourself and when to bring in an MSSP, MDR provider or auditor. * Clear, direct communication in English, written and spoken, with the ability to present risk to a board and explain controls to a plant administrator. * Willingness to travel regularly to across Europe, with extended time on site after each acquisition. * Right to work in the UK, Switzerland or the EU, and eligibility for a national security clearance in at least one of our operating countries. * We operate our business in English but fluency in one or more additional European languages is beneficial. * An existing national security clearance (UK SC/DV, German Ü2/Ü3, NATO Secret or equivalent). * Experience in a defence contractor, a government security agency, or a company handling classified or export-controlled material. * Experience with M&A security: diligence, day-one integration playbooks, and consolidating IT across acquired companies. * Hands-on OT security experience (IEC 62443, Purdue model, vendor remote access) in manufacturing. * Security engineering background - you can read code, review an architecture, and have opinions about how software should be built securely. * Certifications such as CISSP, CISM, ISO 27001 Lead Implementer or GIAC - or strong opinions about why they don't matter. * Experience in a scale-up or PE-backed platform where you built the function from one person up. ## Description * Run Onodrim's own estate. Operate and harden identity and access, endpoint management, the productivity suite and the rest of the SaaS stack. * Secure the sub-cos. Within the first weeks after each acquisition, assess the company's security posture, fix what is urgent, and bring it onto the platform standard over time - without disrupting production. * Support the deal team. Run security and IT due diligence on acquisition targets: what they run, what has happened to them, what it will cost to fix, and what could kill the deal. * Protect the shop floor. Bring OT and industrial control systems into scope: network segmentation, machine access, vendor remote access, and the gap between the IT and OT teams. * Lead incident response. Own detection, response and recovery across the platform; run tabletop exercises; be the escalation point when something happens at 02:00 at a sub-co. * Get and keep the certifications that unlock business. Drive ISO 27001, NIS2 readiness and the national defence-industry and classified-information requirements (e.g. BSI, Facility Security Clearance equivalents) that our customers and partners demand, and support export-control compliance (ITAR/EAR, EU dual-use) on the technical side. * Manage third-party and supply-chain risk. Assess vendors, cloud providers and partners; put the right contractual and technical controls in place. * Run corporate IT for the Top-Co. Own device procurement and lifecycle, joiner/mover/leaver, SaaS licensing and administration, and first-line support - either directly or through a managed provider you select and manage. * Set the sub-co IT model. Decide what gets consolidated (identity, email, endpoint, backup), what stays local, and how plant IT teams plug into the platform. * Build the function. Hire and manage security and IT staff as the platform grows; select and manage MSSPs, MDR providers and auditors in the meantime. * Make security usable. Write policies people can follow, train staff, and design controls that a 20-person company and a 500-person manufacturer can both live with.