115K–145K GBP / year
Security & Privacy Lead
OtherHybrid — London, UK
Published on 2026-11-09
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Own and scale Scarlet’s ISO 27001 information security management system and GDPR privacy programme. Partner with engineering and the wider company to implement practical controls, manage security risks, and support safe adoption of AI tools.
About the company
Scarlet is a notified body that certifies AI and software medical devices under EU MDR and UK MDR without unnecessary delays.
What you'll do
- Own and improve the ISO 27001-certified ISMS and GDPR-compliant privacy programme
- Implement and maintain security controls hands-on
- Assess security and privacy risks of vendors and AI tools
- Help build a secure-by-design internal AI tools ecosystem
- Lead threat modelling with engineers and drive penetration-test findings to resolution
- Represent security and privacy to customers
- Monitor systems and operations for practical vulnerabilities
What we're looking for
- Experience owning an ISMS through ISO 27001 certification or surveillance audits
- Experience running a GDPR compliance programme
- Hands-on experience implementing security controls
- Experience scaling repeatable compliance processes
- Experience assessing third-party security and privacy risks
- Experience working with engineers on threat modelling and penetration-test remediation
- Ability to explain technical trade-offs clearly to non-technical audiences
Nice to have
- Experience in a highly regulated environment, such as medical devices or conformity assessment
- Experience with SOC 2 or other security attestations
- Knowledge of AI regulation or standards, such as the EU AI Act or ISO 42001
- Experience securing or administering business AI platforms or agent tooling
- Experience automating compliance work
Benefits
- Equity
Hiring process
- 30-minute remote introductory chat
- 30-minute remote compliance knowledge chat
- 30-minute remote technical knowledge chat
- 45-minute remote case interview
- Two 20-minute onsite culture-fit chats