1 to 25 of 243 Permanent SOC 2 Jobs in London

suppliers to. Our own assurance is part of the product promise: we are ISO 27001 certified, hold Cyber Essentials Plus and have achieved SOC 2 Type 1. The team works closely with Engineering, Product, Sales, Customer Success, People and Finance, making security and compliance something that helps … work, not delegate it. There's no team to inherit. You'll be the person who keeps ISO 27001 running, takes us from SOC 2 Type 1 to Type 2, and owns the risk framework the leadership team relies on. It's a highly collaborative role: expect ...

scale. This is a broad, hands-on role spanning cloud and application security, vulnerability management, identity and access management, incident response, secure software delivery, SOC 2, risk management, and customer security assurance. You'll be the internal owner for security: maintaining a clear view of our security posture … clear actions with owners and deadlines, and follow them through to remediation or explicit risk acceptance. You’ll also own our day-to-day SOC 2 programme and audit readiness. That means making sure our controls reflect how Lantern actually operates, maintaining Vanta, coordinating evidence and auditor requests ...

Manager role You’ll own compliance execution at Light. Reporting to the Head of Finance & Core Ops , you’ll be responsible for running our SOC 1, SOC 2, and PCI programmes end to end, keeping us audit-ready, and making sure controls actually work in practice. This … Kubernetes via Tanka/Jsonnet Datadog and CloudWatch for logging and monitoring 25 engineers scaling to 50+, distributed team What you’ll own Run SOC 1, SOC 2 (Type I & II), and PCI DSS etc compliance programmes Plan and manage audits, timelines, and auditor relationships Own evidence ...

security design and architecture reviews, paired with the governance and process work that scales the program. You will partner on customer due‐diligence and SOC 2 evidence and turn security controls into repeatable workflows that fit how the business already works. You will apply that lens across … and DevOps to reduce risk through secure design and simplicity, not just added controls. Governance, Risk & Compliance Partner on customer due‐diligence (DDQ) and SOC 2 Type II evidence gathering, keeping compliance sustainable rather than fire‐drilled. Build repeatable security workflows that embed controls into existing engineering processes ...

and are operating effectively to mitigate risk. The ideal candidate has strong experience in control testing, audits, and compliance frameworks (e.g., ISO 27001, NIST, SOC 2, NIS2), combined with analytical thinking and stakeholder engagement skills Join us and you will be part of a fast-growing community … effectiveness Identify control gaps, deficiencies, and areas for improvement Compliance & Risk Alignment Assess controls against relevant frameworks (e.g., ISO 27001, NIST CSF, CIS Controls, SOC 2, NIS2) Assess control effectiveness across: Design Effectiveness (DE), Operating Effectiveness (OE) and Control Automation (CA) Support regulatory and internal compliance initiatives Ensure ...

align with a cloud-first strategy. Partner with Security to harden the Microsoft 365 tenant and infrastructure estate against relevant compliance frameworks (ISO 27001, SOC 2, DORA). Technical Leadership Act as a senior technical point of contact for infrastructure design decisions, escalations, and complex troubleshooting. Change Control … Intune and Kandji are compliant, patched, and enrolled to policy. The Microsoft 365 tenant and wider SaaS estate meet relevant compliance frameworks (ISO 27001, SOC 2, DORA). Infrastructure changes are documented, tested, and follow IT change control processes without exception. Technical documentation, runbooks, and architecture records ...

overflow. You are taking over a production estate that is highly specific: a Node.js application and public API running on Amazon EKS (eu-west-2) , backed by Aurora MySQL 8 (with a read replica) and ElastiCache Redis , fronted by ALB and CloudFront/WAF. Everything is codified using Terraform …/CodeBuild. Observability runs on CloudWatch and a self-hosted Prometheus/Grafana cluster stack, paging via PagerDuty. You will also directly own our SOC 2 compliance programme, keeping controls green via Vanta. What You'll Do Run EKS Production: Own our live AWS environment, handling EKS node ...

markets, regulators, auditors, and enterprise partners expect provable, continuously operating security controls — not slide decks or one‐off audits. Compliance requirements (DORA, GDPR, SOC 2, ISO 27001, and region‐specific regulations) are increasing faster than our ability to operationalize them, and this role exists to close that gap. … Amsterdam, Netherlands (EU/EEA). Key Responsibilities Own audit-ready security controls Design, implement, and maintain technical and operational controls for DORA, GDPR, SOC 2, ISO 27001, and future regional requirements. Ensure controls are not just documented, but actually enforced in AWS, Kubernetes, and application layers. ...

play a key role in protecting our leadership team from targeted attacks, serve as the technical backbone of our ISO 27001 and SOC 2 programmes, and partner with our DevOps and Platform teams on cloud security. Above all, you'll help us stay safe while keeping our pace. … from targeted phishing, impersonation, business email compromise, and AI-enabled fraud such as deepfakes. Act as the technical owner of our ISO 27001 and SOC 2 controls, from policies and evidence through to auditor walkthroughs. Lead third-party and vendor risk assessments. Respond to and lead security incidents ...

paperwork exercise at the edge of the business. It is a condition of doing business. We are working toward ISO 27001 certification and SOC 2 Type II attestation across a company that is scaling quickly, operating multi-tenant infrastructure in several countries, and deploying into partner data centers. … actually working or only described. What You Will Be Doing Compliance Execution Implement and maintain the control set defined for our ISO 27001 and SOC 2 Type II programs, tracking status, owners, and gaps against the certification timeline. Operate our GRC platform (Vanta) day to day: configure and ...

large case files, test arguments and produce high-quality work grounded in the full matter record. Crimson is enterprise-grade by design. We are SOC 2 Type II attested, encrypt data in transit and at rest, and maintain rigorous controls across our product, infrastructure and operations. Security … continuous learning Coordinate independent penetration testing and represent Crimson's security posture in customer security reviews Maintain the controls and evidence supporting Crimson's SOC 2 Type II attestation and enterprise customer requirements Embed practical security guidance and tooling into a fast-moving engineering environment What ...

when necessary to support them. You will own the IT strategy and roadmap, service performance, vendor procurement outcomes, and the IT control environment, including SOC 2, Cyber Essentials, and GDPR-related IT controls. You will plan and manage the project portfolio, hold vendors and the team to account … outcome, the Indeed relationship, and vendor performance Security, Risk & Compliance: Own the IT control environment and security posture, including policy, access standards, SOC 2, Cyber Essentials, GDPR-related IT controls, and audit outcomes. Direct the team's evidence gathering and control maintenance, and represent IT on security and ...

and close the coverage gaps where some products are today outside the standard tooling. Governance, risk and compliance and vendor management Own ISO 27001, SOC 1, SOC 2 and PCI DSS compliance, the audit calendar, the compliance automation platform and the relationship with our auditors. Work with … software or SaaS company serving regulated enterprise customers, and of facing those customers on security matters. Working knowledge of ISO 27001 and SOC 2, and experience of being accountable for audits and certifications. PCI DSS experience is an advantage. Practical understanding of cloud security on AWS and Azure ...

Mozilla is seeking an experienced GRC/compliance professional to maintain and mature the ISMS, support ISO 27001 and SOC 2 Type 2 audits, and lead policy programs across cross-functional teams in a remote UK setting. You will partner with Engineering, IT, Legal, Privacy, and product ...

Access Transparency, relevant to deploying per-market for different banks' regulators Hands-on experience taking a company through security and compliance frameworks like NIST, SOC 2, ISO 27001 and PCI DSS Experience automating security controls and compliance checks against standards and frameworks including SOC 2 ...

Senior Security Engineer (Network IAM SOC) London/WFH to £100k Are you a senior, hands-on Security Engineer with a strong networking background? You could be progressing your career at a well-funded and profitable FinTech scale-up. As the Senior Security Engineer, you'll take ownership … Zero Trust principles. You'll also oversee improvements across endpoint hardening, vulnerability management, IAM, cloud security and internal controls. Working with an outsourced SOC and MDR provider, you'll ensure security monitoring and escalation processes are effective, while helping progress initiatives such as SASE and SOC 2 ...

represent security in senior management discussions. Liaise with the Data Protection Officer to align security controls with privacy obligations and regulatory requirements. Oversee global SOC operations including monitoring, detection, incident triage, & forensic investigations. Ensure advanced protection across Microsoft 365, Azure, Intune, Defender, Sentinel SIEM, Cloudflare, DNS, & on-prem environments. … security risk management framework & risk register. Lead all customer assurance & Due Diligence Questionnaire (DDQ) responses. Manage compliance with ISO 27001/27002, NIST CSF, SOC 2, CIS, DORA, CE/CE+ requirements. Oversee internal/external audits, ensuring evidence collection, remediation tracking, & executive reporting. Perform supplier & project risk ...

ITSM compliance across all identity teams, with standardised incident, change, and problem management workflows. Security, Compliance & Risk Management Ensure alignment with ISO 27001, NIST, SOC 2, GDPR, and applicable identity‐specific compliance frameworks across all teams. Partner closely with ISRM to translate policy requirements into enforceable, automated technical … and automated workloads — with appetite to shape the emerging agentic identity domain. Strong understanding of compliance frameworks and their identity implications (ISO 27001, NIST, SOC 2, GDPR). Excellent leadership, communication, and stakeholder management skills with the ability to engage from engineering teams to executive leadership. Preferred Qualifications ...

activities across engineering and security teams, ensuring alignment with agreed timelines and compliance requirements. Audit Audit Interpretation: Read and interpret third-party audit reports (SOC 2 Type II, ISO 27001, penetration test summaries) and represent findings to customers in questionnaires and security responses. Communication & Stakeholder Management Information Translation … experience responding to SIG, CAIQ, VSA, and bespoke enterprise/government security questionnaires. Compliance Knowledge: Working knowledge of Cyber Essentials Plus, ISO 27001, SOC 2 Type II, and at least one of PCI DSS, GDPR/UK GDPR, HIPAA, or FedRAMP. Technical Expertise: Strong technical understanding of security ...

response across application and cloud layers: triage, containment, forensics, root cause analysis, and post-incident hardening.Partner with Privacy/Compliance so platform controls satisfy SOC 2 Type II, ISO 27001, PCI DSS, and GDPR, and design decisions stay defensible and auditable.Scale security through people. Build a Security Champions … transit.Experience running vulnerability management or a bug bounty/pentest program, and driving remediation across teams you don't manage.Strong working knowledge of SOC 2 Type II, ISO 27001, PCI DSS, and GDPR.Ability to turn complex security concepts into clear guidance for engineers and risk-based recommendations ...

creating operational friction. Responsibilities Lead penetration testing and vulnerability assessment engagements Design security architectures for cloud-native and hybrid environments Develop security compliance programs (SOC 2, ISO 27001, GDPR) Conduct incident response planning and tabletop exercises Advise C-level executives on security strategy and risk management Requirements 8+ … years in information security with consulting experience Deep expertise in penetration testing, vulnerability management, and threat modeling Knowledge of compliance frameworks: SOC 2, ISO 27001, GDPR, PCI-DSS Experience with cloud security (AWS Security Hub, Azure Defender, or GCP Security Command Center) CISSP, OSCP, or equivalent certification Nice ...

strictly aligned with corporate security standards and global regulatory compliance. Cloud Security & Compliance: Ensure compliance with relevant compliance and regulatory frameworks (e.g., ISO 27001, SOC 2, GDPR as applicable) and implement best practices cloud security controls. Security Operation: Lead security first approach, collaborate with Security and IT teams … stakeholder management skills; ability to influence across engineering, security, and finance. Experience with regulated industries (e.g., healthcare, fintech). Familiarity with multiple compliance frameworks (SOC 2, HIPAA, PCI-DSS). WHAT YOUR SUCCESS WILL LOOK LIKE By the half-year mark, you will have moved beyond the onboarding ...

secret rotation and offboarding. Connectors Microsoft 365 and the other sources we read handling tokens, scopes and permissions safely. Compliance The controls behind our SOC 2 and ISO 27001 work in Vanta, with the auditor and pen-test firm you choose and manage. Security answers The security pack … major cloud, GCP ideally, Azure or AWS welcome, and written the infrastructure as code for it. You have been the person who got a SOC 2 or ISO 27001 audit through at a startup or scale-up, and can name the controls you owned and the evidence ...

available, and optimized for both performance and cost. Key Responsibilities Architect, implement, and maintain cloud infrastructure to support rapid product growth. Prepare infrastructure for SOC 2/ISO 27001 audits, aligning with customer expectations. Build and maintain CI/CD pipelines for backend, frontend, and data services … Experience implementing reliability, security, and compliance measures ahead of scale‐up or audit readiness. History of driving cost efficiency while enabling growth. Exposure to SOC 2, ISO 27001, or GDPR compliance processes. What We Offer You will be reporting directly to the founders, who have two successful venture ...

lasting improvement to systems and controls AI security , including prompt injection, unsafe tool execution, retrieved data and sensitive information disclosure Evidence and assurance for SOC 2, enterprise security reviews and customer due diligence, plus the reusable security patterns engineering teams adopt as standard What We’re Looking … code, and enterprise identity integrations such as OAuth, OIDC and SAML Detection engineering, SIEM or cloud security monitoring, incident response or digital forensics SOC 2, ISO 27001 or enterprise customer security reviews Penetration testing or working with external security researchers What We Offer Competitive salary with regular appraisals ...