IT Compliance & Security Officer

Compliance and Risk

• Own the IT evidence program across ISO 27001:2022, SOC 1, SOC 2, PCI DSS, and HIPAA for a portfolio of approximately thirteen operating sites.

• Act as IT's counterpart to external certification bodies and auditors — prepare for audits, present and defend control evidence, and own remediation of IT findings through to closure.

• Manage third-party and vendor risk management for IT: vendor security assessments, a maintained vendor register with periodic reassessment.

• Own customer-facing security due diligence — questionnaires, audits, and assessments.

• Maintain the IT risk register and opportunities-for-improvement log, and drive items to closure rather than allowing them to age.

• Coordinate IT participation in business continuity and disaster recovery testing, and ensure results are documented.

Security Operations

• Manage vulnerability management end to end — scanning coverage, triage, remediation ownership, escalation of anything aging, and periodic reporting to leadership.

• Work alongside counterparts to oversee endpoint detection and response and the security alerting pipeline; ensure alerts reach an owner and that investigations are recorded and closed.

• Lead security incident response — containment, investigation, root cause, customer-facing incident reporting, and post-incident hardening.

• Manage email security, including domain authentication posture and secure email gateway configuration.

• Run the security awareness program — monthly phishing simulation, results analysis, and targeted follow-up.

Identity and Access

• Contribute to identity governance across a hybrid estate spanning cloud and on-premises Identity Provider (IdP).

• Oversee access review cadence, privileged access controls, and the joiner-mover-leaver process from an IT control standpoint, including third-party and contractor access.