Description

Key Responsibilities

• 
  Own the group’s cyber security strategy, posture and risk register — the most senior security accountability in the business below the Group IT Director.

• Lead all formal security certifications end-to-end: Cyber Essentials Plus annual recertification, IASME Cyber Assurance alignment and ISO 27001 ISMS — scoping, risk treatment, Statement of Applicability, internal audits, management review and external audit defence.

• Apply additional frameworks where they strengthen the group’s posture — NIST CSF, CIS Controls, NCSC Cyber Assessment Framework — and embed them into operational practice.

• Act as the group’s Data Protection Lead (not a statutory DPO under UK GDPR Article 37) — own UK GDPR and DPA 2018 compliance, ROPA, DPIAs, retention schedules, DSARs, breach notification, processor agreements and supplier due diligence.

• Run security operations day-to-day — endpoint protection (Bitdefender GravityZone), conditional access, MFA, identity governance, vulnerability management, and security awareness and phishing simulation programmes via KnowBe4.

• Lead incident response — triage, containment, recovery, post-incident review and reporting, with playbooks kept current and tested.

• Oversee security across Auro Technology’s software stack — IoT device firmware, cloud platforms, mobile and web applications — partnering with the Auro engineering team on secure SDLC, code review, dependency management, secrets handling and product security posture.

• Act as the security gatekeeper for IT project handovers — accept newly delivered systems from IT Project Managers into BAU only once documentation, monitoring, support runbooks and security controls meet the group’s bar.

• Run vendor and licensing relationships across the IT and security stack — renewals, commercial negotiation and security due diligence on every new supplier before they are onboarded.

• Run the day-to-day IT function in service of the security mission — line-manage the IT Technician, oversee the Atera helpdesk, own SLAs and personally take the hardest tickets when they have a security dimension.

• Maintain infrastructure resilience — backups, disaster recovery, business continuity, identity, network and connectivity — owned, documented and tested.

• Run secure onboarding and offboarding at scale, keeping identity hygiene and asset control airtight as the group grows.

Skills, Knowledge and Expertise

• 
  An A-player mindset — high standards, extreme ownership and the drive to do things properly, the first time.

• A security professional first and foremost — your career identity is cyber security and information assurance, not IT generalism that happens to include security.

• Proven track record leading Cyber Essentials Plus and ISO 27001 (or actively driving towards certification) in a real organisation — not a tabletop exercise.

• Strong working knowledge of UK GDPR and the Data Protection Act 2018, with hands-on experience of DSARs, DPIAs, breach response and supplier DPAs.

• Deep, hands-on Microsoft 365 and Entra ID security experience — conditional access, Intune, identity governance, the Defender stack and security baselines.

• Demonstrable security operations experience — EDR/XDR, vulnerability management, incident response and security awareness programmes.

• Pragmatic, hands-on operator — comfortable running a helpdesk and line-managing an IT Technician alongside the security and compliance remit.

• Confident commercial mindset — budget ownership, vendor negotiation and the ability to challenge supplier security claims with evidence.

• Excellent written and verbal communication, able to translate technical risk plainly for non-technical leadership and field staff.

• Right to work in the UK and able to travel between London, Yeovil, Chesterfield, Edinburgh and other group sites as required.

• Recognised certification — CISSP, CISM, ISO 27001 Lead Implementer or Lead Auditor, Microsoft SC-100 / SC-200 / SC-300.

• IASME Cyber Assurance experience.

• Formal Data Protection Officer training or qualification (e.g. PC.dp, BCS Practitioner Certificate in Data Protection).

• Experience in fire safety, construction, manufacturing or field-engineering environments.

• Familiarity with our wider stack — Salesforce, SimPRO, Unleashed, Supabase, Cloudflare, Microsoft Fabric.

• Hands-on experience with KnowBe4 (or equivalent security awareness and phishing simulation platforms).

• NIST CSF, CIS Controls or NCSC CAF practical experience.

Benefits

About Harmony Fire