Head of Information Security and Compliance

The Role

This is the senior security role in the group, and it is yours to build. You will hold the certifications, front the audits, and be the person our customers, insurers and board ultimately rely on.

We have grown fast through acquisition. That means several entities in three countries, each at a different level of maturity, with overlapping but non-identical obligations. Your job is to bring them onto one coherent, credible programme, and keep it that way through the next acquisition. You will do it with a small team and a lot of autonomy, so pragmatism matters more here than process for its own sake.

What You'll Own

• ISO 27001 and Cyber Essentials Plus across every entity: scope, evidence, audits, recertification, and pulling newly acquired businesses in. If SOC 2 becomes commercially necessary, you will make that call and lead it.

• The ISMS and the policies behind it. Current, genuinely used, and credible to an auditor.

• GDPR across three jurisdictions: processing records, DPIAs, transfers, subject requests, breach notification.

• Customer security assurance. Questionnaires, due diligence packs, and the security terms in contracts and DPAs. You will join the calls where deals are won or stalled on security.

• Incident response, end to end. You own the plan, you run the response, and you make sure the post-mortem actually changes something.

• Business continuity and disaster recovery for group systems, tested at least annually, plus tabletop exercises with the leadership team.

• The security baselines for endpoints and internal systems such as CRM, ERP, email and collaboration. IT Operations implements them. You set them, and you verify them.

• Risk register, access reviews and control testing, reported straight to the executive team.

• External partners: MSPs, penetration testers, security vendors, and the cyber insurance relationship.

• Security awareness that people absorb rather than click through.

What This Role Is Not

Security of the SINGU product and the infrastructure hosting it belongs to Platform Engineering. Day-to-day administration of laptops and internal systems belongs to IT Operations. You set the standard and hold both to it. You are not the person reimaging a laptop.

What We're Looking For

• You have led information security and compliance, ideally as the most senior security person in the business.

• You have taken ISO 27001 through at least one full audit cycle and know where the bodies are buried.

• You have applied GDPR in practice, in more than one country.

• You have matured security across businesses at different stages, ideally in a group built by acquisition.

• You build programmes pragmatically. You can tell the difference between real risk reduction and theatre, and you protect business velocity while cutting the latter.

• You are credible in front of customers, auditors and the board, and can hold a technical line without becoming the reason a deal dies.

• CISSP, CISM or equivalent.

• Strong professional English. Polish is useful, not essential.

Why You'll Want This

• Full ownership of security for an international SaaS group, with direct access to the executive team.

• A programme you shape rather than inherit. Real problems, real budget, and the mandate to fix them properly.

• Security here enables revenue. It is a visible commercial role, not a back-office one.

• The group is still growing. What you build now becomes the standard for everything we acquire next.

• Competitive salary, aligned to seniority of the role

• Private medical care, sport card, life insurance, an annual training budget, a team integration budget, and more