IT Security & Compliance Lead (London, UK)

<div class="content-intro"><hr> <p> </p></div><p><em><span style="font-weight: 400;"><strong>Please Note: </strong>B Lab is <strong>not</strong> working with a third party to fill this role an no part of our process requires applicants to pay fees. Applicants should only use our job board to submit an application, and will interact directly with our team during this process.</span></em></p> <hr> <p><em><span style="font-weight: 400;">This is a <strong>Full-Time</strong> Role (40 hours per week, 5DWW) with no option for part-time work. While this is a remote-first opportunity, the candidate filling this role must be a resident of the Netherlands or in the U.K. at the start of employment. Additionally, they must be within commuting distance of our office in Amsterdam or London. <br></span></em><em>Please visit <a href="https://boards.greenhouse.io/blab" target="_blank">our Careers page</a> to review all opportunities and submit your application for the role(s) that best fit your location and work authorization. <strong>This job ad will close automatically at 9:00AM EST on October 27th</strong>.</em></p> <hr> <h2><strong>About the Team</strong></h2> <p><span style="font-size: 12pt;">The Technology & Data portfolio, provides the digital infrastructure, engineering and data capabilities that enable effective delivery, innovation and learning across the B Lab Global Network. It brings together four groups: Technology & Data Leadership, Product & Platform Engineering, Data & AI, and Infrastructure & Information Management.</span></p> <p><span style="font-size: 12pt;">Infrastructure & Information Management (Operational Technology) is responsible for information security, workforce enablement and the adoption of digital tools across the network. It ensures resilience through secure, reliable infrastructure, and manages hosting, networks, access and incident response. The team is evolving from a function that supported a relatively uniform, single-organization tech stack of approximately 150 users into a globally coordinated department supporting approximately 500 users across a broad range of regions, time zones, languages, technical maturity levels and operational practices.  As B Lab consolidates multiple historically independent organizations into a unified operating model through the network transformation, Op Tech is adding regional IT support coverage (US & Canada, Europe, UK, Latin America, APAC & AANZ, with shared coverage for Africa) and dedicated security ownership, while keeping centralized governance, platform ownership and alignment of internal technology initiatives.</span></p> <h2><strong>About the Opportunity</strong></h2> <p><span style="font-size: 12pt;">B Lab is seeking an <strong>IT Security & Compliance Lead</strong> to own security governance across the global network. Consolidation increases security exposure as organizations with different controls come together, and this role exists to set a consistent baseline and raise our security posture proactively rather than reactively.</span></p> <p><span style="font-size: 12pt;">The Lead conducts security audits and risk assessments, sets and enforces baseline security standards, maintains our information security policy set, coordinates incident response, and supports data protection compliance in the jurisdictions where B Lab operates. Working closely with the Senior Manager of Infrastructure & Information Management, the Regional IT Administrators, and the product, engineering and data teams (including the Data Governance Lead), this role drives consistent security maturity across the network's systems and helps people across the network work securely.<br><br></span></p> <h2><strong>Core Responsibilities </strong></h2> <h4><span style="font-size: 12pt;"><strong>Security Governance, Audits, and Assessments</strong></span></h4> <ul> <li style="font-size: 12pt;"><span style="font-size: 12pt;">Conduct regular security audits and risk assessments of network systems, applications and processes, and maintain a prioritized risk register</span></li> <li style="font-size: 12pt;"><span style="font-size: 12pt;">Establish and maintain a security baseline across the network, aligned to a recognized framework (for example ISO/IEC 27001:2022)</span></li> <li style="font-size: 12pt;"><span style="font-size: 12pt;">Track and report security posture and maturity over time to the Technology leadership team, with clear metrics</span></li> <li style="font-size: 12pt;"><span style="font-size: 12pt;">Run security reviews of new and existing vendors and technology platforms (third-party risk), including SaaS tools used by regional and market teams</span></li> <li style="font-size: 12pt;"><span style="font-size: 12pt;">Coordinate external penetration testing and vulnerability scanning, and track remediation with system owners</span></li> </ul> <h3><span style="font-size: 12pt;"><strong>Identity, access and platform security</strong></span></h3> <ul> <li style="font-size: 12pt;"><span style="font-size: 12pt;">Define and monitor access control standards (MFA, SSO, least privilege, joiner/mover/leaver processes) across core platforms such as Google Workspace and Salesforce</span></li> <li style="font-size: 12pt;"><span style="font-size: 12pt;">Partner with Region