Security & Privacy Lead

UK - London Office, Remote. Posted 5 days ago

The role

The Security & Privacy Lead will own the ISO 27001-certified information security management system and the data privacy programme. This person will work with engineering to find and fix risks and shape how the company adopts AI tools safely.

What you will do

Own and improve Scarlet's ISO 27001-certified ISMS.
Own and improve Scarlet's GDPR-compliant data privacy programme.
Be hands-on with implementing and maintaining controls.
Perform information security and data privacy risk assessments for vendors and AI tools.
Help build Scarlet's internal ecosystem of AI tools.
Lead threat modelling with engineers.
Commission external penetration tests and drive findings to resolution.
Represent Scarlet's security and privacy to customers.
Proactively monitor systems and operations to spot real vulnerabilities.

Required qualifications

Experience owning an ISMS through ISO 27001 certification or surveillance audits.
Experience running a GDPR compliance programme.
Track record of being hands-on, implementing security controls yourself.
Evidence of building a programme that scales.
Experience assessing the information security and data privacy risks of third-party services.
Experience working with engineers on threat models and penetration test remediation.
Technical judgement to read an architecture and challenge it.
Experience explaining technical trade-offs clearly to non-technical colleagues and customers.

Nice to have

Experience working in a highly regulated environment, such as medical devices or conformity assessment.
Experience with SOC 2 or other security attestations.
Knowledge of AI regulation and standards, such as the EU AI Act or ISO 42001.
Experience administering or securing AI platforms or agent tooling in a business setting.
Experience automating compliance work.

Before you apply

Intro chat with Niclas (30 min, remote)
Compliance knowledge chat with Tom (30 min, remote)
Technical knowledge chat with Alan (30 min, remote)
Case with Niclas (45 min, remote)
Culture fit chats with James and Jamie (20 min each, onsite)

About the company

Scarlet is authorised to assess and certify medical devices. They combine clinical, technical and regulatory expertise with AI agents and software.