Information Security Lead

Role The Information Security Lead exists to make security an operating discipline across ACQ, with clear ownership for information security operations, incident readiness, risk, and the ongoing operation of ISO 27001 and ISO 42001. ACQ holds data from thousands of client businesses and uses AI across its products and internal operations. We've established foundational identity controls, and we're moving from certification readiness into the daily work of keeping our management systems effective, our risks visible, and our response capabilities ready. This is a hands-on, founding information security role with its deepest ownership in GRC and security operations. You will build repeatable operating systems, lead investigations, and provide an independent view of risk. You will also bring enough technical depth to review application and infrastructure code, understand attack paths, and work with engineering owners on practical code remediation. You will report to the IT Systems Manager, partner daily with platform, application, and AI engineering, collaborate with Legal on privacy, and work with the CTO as an executive sponsor of the function. Responsibilities - Operate the ISO 27001 and ISO 42001 management systems through continuous evidence collection, risk management, control testing, internal audits, management reviews, corrective actions, and surveillance audit preparation. - Build and run security operations across centralized logging, detection engineering, alert triage, incident response, security investigations, insider-risk escalation, tabletop exercises, and post-incident improvement. - Own the information security operating model, including policies, standards, risk acceptance, vulnerability governance, quarterly leadership reporting, security awareness, and the roadmap for maturing the function. - Lead identity, access, vendor, and data-protection controls through privileged-access governance, quarterly reviews, third-party assessment, classification, retention, deletion, and clear boundaries between operating companies.

- Provide independent technical assurance across applications and cloud systems by reviewing architecture, application code, infrastructure-as-code, IAM policies, CI/CD workflows, and material vulnerabilities with the engineers who own remediation. - Establish security and governance controls for AI systems, including inventories, impact assessments, model and tool access, agent permissions, prompt-injection and data-exfiltration risks, audit trails, and tested shutdown mechanisms. Requirements - 7+ years of information security experience, including experience operating ISO 27001 programs. Active CISSP certification, or eligibility and commitment to obtain it within six months of hire, is required; ISO 42001 and CGRC experience are preferred. - Experience remediating security incidents, including practical experience building logging, monitoring, and detection capabilities. - Ability to read and write code, ideally in Python and JavaScript/TypeScript, to identify potential attack paths, assess vulnerabilities, and recommend code-level fixes. - Proficiency with infrastructure-as-code tools such as Pulumi or Terraform, cloud IAM, and deployment workflows. - Knowledge of AI and agentic systems, with experience establishing practical security controls for their use. - Experience serving as a foundational or sole information security owner is highly preferred. Results - ISO 27001 and ISO 42001 operate on a continuous cadence, with current evidence, tested controls, reviewed risks, and corrective actions ready for surveillance audits. - Security signals are centralized and actionable, incident procedures are rehearsed, investigations are handled with clear ownership, and lessons produce verified control improvements.