Head of Information Security

Overview

In this role you will define and lead MOO’s security and privacy agenda to protect customer trust while enabling growth. You will partner with Technology, Product, Legal and Leadership to build scalable governance, compliance, and resilience capabilities across a cloud-first environment. You’ll drive incident response, third‑party risk management and security programs tailored to ecommerce and data‑driven business needs. This is a hands-on leadership role at a growth-focused company that values pragmatic collaboration and continuous improvement.

Pay / Benefits

• 25 days holiday
• matched pension scheme
• paid parental leave
• private healthcare
• life insurance
• season ticket loan

Responsibilities

• Define and lead the security strategy and programmes
• Establish governance and compliance frameworks (GDPR, PCI-DSS)
• Strengthen cloud security and third-party risk management (AWS)
• Lead incident response and resilience planning across the organisation
• Partner with Technology, Product, Legal, Finance, and Operations to balance security with business delivery
• Translate security risks into practical business decisions
• Foster a collaborative cross-functional security culture
• Drive continuous improvement and enablement instead of gatekeeping

Key requirements

• 10+ years in information security with leadership responsibility
• Experience building and scaling security and privacy programmes
• Strong hands-on knowledge of GDPR, PCI-DSS, incident response, and resilience
• Experience in cloud-first environments, ideally AWS
• Understanding of security in ecommerce/fintech/customer-data-led businesses
• Able to be both strategic leader and hands-on practitioner
• Excellent stakeholder management and executive communication skills
• Cross-functional partnership experience across Engineering, Product, Legal, Finance, and Operations
• Builder mindset focused on enabling delivery and growth

• Stakeholder management
• Executive communication
• Collaborative and pragmatic approach
• GDPR
• PCI-DSS
• Incident response

…