Information Security & Risk Officer

Overview

In this role you will strengthen Accurx’s information security and risk posture across the business. You’ll partner with Engineering, DevOps, IT and Product to identify risks, advise on controls, and drive compliance programs. You will own risk sessions, the risk register, and audit readiness for frameworks like ISO 27001, DSPT, and Cyber Essentials Plus, while supporting customers and tenders. This role is delivery-focused in a fast-moving health-tech environment, with real impact on patient data protection and platform security.

Pay / Benefits

• salary 65,000–75,000
• equity options
• flexible benefits (healthcare cover, pension, life insurance)
• office-first with hybrid 3 days in Shoreditch
• regular hackathons and practice site visits
• 28 days holiday plus bank holidays; up to 4 weeks remote work per year

Responsibilities

• Own risk management processes: run risk sessions, maintain risk register, write risk reports, drive treatment actions
• Advise cross-functional teams on security requirements and responses
• Respond to security questionnaires and tenders; assess suppliers prior to approval
• Maintain audit readiness: gather evidence for Cyber Essentials Plus, DSPT, ISO 27001 and identify control gaps
• Drive data classification and access control programs with data owners
• Support security governance across Engineering, DevOps, IT and Product
• Engage in healthcare data protection efforts and ensure patient/clinician data safety
• Balance fast delivery with risk-aware decision making

Key requirements

• Hands-on information security and risk experience, ideally in health-tech, regulated SaaS or software development
• Experience running risk sessions, managing risk registers, reporting to senior stakeholders
• Technical depth in authentication vs authorization, IAM, least privilege, network segmentation, firewalls, patch and vulnerability management, endpoint protection, cloud infrastructure
• Familiarity with ISO 27001, DSPT, NIST and Cyber Essentials Plus
• Ability to work independently and manage multiple tasks across tenders, questionnaires, and engineering discussions
• Understanding of healthcare data protection and the value of patient data

• Fast, autonomous worker
• Strong communicator with cross-functional stakeholders
• Pragmatic problem-solver with risk-focused mindset
• IAM
• Authentication vs authorization
• Least privilege

…