What you'll do: - Lead security triage as the first line of defense, assessing new CVEs, vulnerabilities, and supply-chain risk against our live infrastructure, not just a checklist. - Perform hands-on audits including penetration testing and vulnerability management, bringing practical technical judgement. - Own our governance, risk and compliance frameworks, translating policy into controls that work at the infrastructure and code level. - Automate parts of GRC that don't require human input (vulnerability tooling, endpoint protection rollout, policy-to-enforcement mapping) so the function scales efficiently. - Build deep product and infrastructure knowledge so you become the go-to security expert within the team.

What you'll bring: - A technical background (e.g., Computer Science, Information Security) with real-world cybersecurity or IT security management experience. - CISSP or CISM (or equivalent depth of experience); substance is valued over letters. - A track record in incident management and governance, risk and control frameworks, ideally with technical credibility beyond policy. - The confidence to say 'that policy doesn't reflect how this actually works,' and the technical grounding to be right. - A bias toward automation and simplification, not add

What you'll do: - Lead security triage as the first line of defense, assessing new CVEs, vulnerabilities, and supply-chain risk against our live infrastructure, not just a checklist. - Perform hands-on audits including penetration testing and vulnerability management, bringing practical technical judgement. - Own our governance, risk and compliance frameworks, translating policy into controls that work at the infrastructure and code level. - Automate parts of GRC that don't require human input (vulnerability tooling, endpoint protection rollout, policy-to-enforcement mapping) so the function scales efficiently. - Build deep product and infrastructure knowledge so you become the go-to security expert within the team.

What you'll bring: - A technical background (e.g., Computer Science, Information Security) with real-world cybersecurity or IT security management experience. - CISSP or CISM (or equivalent depth of experience); substance is valued over letters. - A track record in incident management and governance, risk and control frameworks, ideally with technical credibility beyond policy. - The confidence to say 'that policy doesn't reflect how this actually works,' and the technical grounding to be right. - A bias toward automation and simplification, not add