Information Security Specialist
I’m working with an elite law firm on an Information Security Pentest Assurance hire, a role that sits at the intersection of pentesting, change governance, and risk ownership.
The business needs someone who can anticipate where testing is required, commission it properly, and make sure findings actually get resolved — not just documented. While the role may say assurance in the title, it is a role that straddles the GRC and the technical.
What the role is really about
- Planning and commissioning security assurance testing across core systems, projects, and infrastructure
- Owning the output of penetration testing, social engineering exercises, and other offensive testing, from validation through to remediation or risk acceptance
- Embedding security into project and change lifecycles, reviewing solution designs and shaping requirements early
- Representing security at technical change forums and advising on risk associated with technical change
- Helping professionalise and standardise how assurance is done across the firm
- Supporting the ISMS, including policies, reporting, and compliance activity
This will suit someone who
- Has solid experience in information security or technical cyber security in a regulated industry
- Practical hand-on experience with pentest assurance
- Is comfortable working with ISO 27001 and Cyber Essentials Plus in practice, not just theory
- Can grasp and translate technical concepts quickly and translate risk clearly for non‐security stakeholders
- Takes ownership, following issues through until they’re genuinely closed
- Enjoys improving how things are done, not just operating existing processes
Why this is interesting
- High trust role with visibility across technology change
- Real influence over how security assurance is defined and executed
- A chance to move away from box‐ticking and into practical, outcome‐driven security
If you’re working in security assurance, technical risk, or cyber governance and want a conversation about scope and fit, drop me a message.