Senior Information Security Engineer

💬 ACCURX IS SOLVING HEALTHCARE PRODUCTIVITY FOR THE NHS. For decades, the NHS has struggled with fragmented systems that make simple tasks feel impossible. At Accurx, we’re changing that by building a single, system-wide platform that helps every patient get gold-standard, efficient, and joined-up care. What started as a way for GPs to text a patient has now evolved into an all-in-one digital toolkit used by 98% of GP practices. Our platform now powers Total Triage to manage patient demand, and Self-Book, which lets patients schedule their own appointments in seconds. We’ve automated routine care with Patient Questionnaires for long-term conditions, while Accumail finally allows staff-to-staff communication to happen instantly across different care settings. We’re now pushing the boundaries of the consultation itself with Accurx Scribe, our AI-powered note-taker that drafts medical notes in real-time. We’re not just shipping features. We’re giving clinicians their time back and ensuring every patient journey is as smooth as it should be. HOW THIS ROLE SITS WITHIN THE FUNCTION * Reports to: Senior Information Security Officer * Function: Privacy & Information Security * Contract type: Six-month fixed-term contract This role works day-to-day alongside the Senior Information Security Officer, who owns the GRC framework, ISO 27001 programme, CE+ and DSPT compliance, and the security risk register. It provides dedicated capacity to push forward priority workstreams - particularly risk management, CE+ audit readiness, and data strategy delivery. CHALLENGES YOU’LL SOLVE... * Own the security risk register: Facilitate risk assessment sessions with technical and non-technical stakeholders across the business, keep the register current and accurate, and prepare clear risk reporting that translates technical risk into business language. * Drive Cyber Essentials Plus readiness: Coordinate evidence gathering across IT, Platform and Security Engineering ahead of the CE+ deep-dive audit, reviewing controls against requirements and flagging gaps with practical remediation guidance. * Deliver our data classification programme: Work with data owners to classify information assets in line with policy, and push the access control programme forward by reviewing current access patterns and identifying gaps. * Keep risk treatment moving: Track risk treatment actions and follow up with owners so items progress rather than stall, managing milestones and blockers across the risk, CE+, and data workstreams. * Support the wider security programme: Contribute to ISO 27001 and DSPT activities where your work intersects, including evidence collection and control documentation, and support policy and process documentation as needed. * Be a translator between security and the business: Communicate security requirements clearly to engineers, and help non-technical stakeholders understand risk well enough to act on it. YOU SHOULD APPLY IF... * You have 3–5 years of hands-on experience in information security and risk management, ideally in health-tech or a regulated SaaS environment. * You've run risk sessions, owned a risk register, and prepared risk reporting for senior stakeholders * You've worked through a Cyber Essentials Plus audit cycle yourself * You understand cloud infrastructure, endpoint management, identity and access controls, and network boundaries well enough to hold your own in a technical conversation - you don't need to be a developer. * You have working knowledge of ISO 27001 and Cyber Essentials Plus, and know what "proportionate" looks like in a fast-moving product company. * You write and communicate clearly, structuring your thinking logically so people know what's expected of them and why. * You're comfortable working at pace and without extensive hand-holding, managing your own workload and flagging blockers early. * You care about what Accurx does, and understand that the data we protect belongs to patients and clinicians who trust us with it. WHAT’S IN IT FOR ME? You'll be joining an established but fast-growing Tech for Good movement, led by our Principles and our mission to solve healthcare productivity. * £50k salary * Benefits to suit you: adjust your healthcare cover, your pension or life insurance, whatever stage you’re at in life * Flexible working: We are an office-first culture and ask that you’re in our (dog-friendly) Shoreditch office 3 days a week, with core hours of 10 am - 4 pm * Time off: You’ll get 28 days of holiday (plus bank holidays) and up to 4 weeks to work from anywhere per year * We have our very own Chef! Free healthy breakfasts, snacks and lunches will be provided, with the occasional sweet treat!

Join Truecaller – The place where innovation meets impact! Truecaller's mission is to build trust in communication by making it safer, smarter, and more efficient. Born in Sweden, trusted by the world, and here’s why we stand out: * We are trusted by over 450 million active users every month across 190+ countries * We identify over 15 billion calls daily, helping users avoid spam and scams * We are powered by a team of 450+ employees from 45+ nationalities We always look for people who take initiative, own their work, and keep raising the bar. An entrepreneurial mindset matters here, especially when it turns bold ideas into real actions. We stay collaborative and focused, always searching for smarter paths forward. If you want to make an impact and grow with a team that inspires millions, you’ll fit right in. The role: As a Senior Cloud Security Engineer, you will act as a technical leader in safeguarding our core cloud infrastructure. You will take ownership of maintaining the highest standards of security controls for our critical systems within Google Cloud Platform (GCP). We're looking for someone who thrives in complex environments, can solve infrastructure security problems where no established patterns exist, and isn't afraid to get their hands dirty. You won't just advise; you will actively build, configure, and fix security controls. You'll leverage your expert understanding of cloud services, infrastructure-as-code, and container security to architect robust security measures and drive systemic improvements across the organization. What you’ll do: * Architect and Lead GCP Security: Take end-to-end ownership of designing and implementing security architectures for our GCP infrastructure. You will look beyond immediate fixes to architect long-term, scalable solutions for networking, compute, storage, and GKE. * Hands-on Remediation & Engineering: You don't just identify risks; you fix them. You will actively write code, create Pull Requests, and apply configurations to resolve security issues, harden infrastructure, and deploy tooling (e.g., EDR, Identity proxies) in production environments. * Drive Systemic Risk Reduction: Identify repeating classes of vulnerabilities or systemic risks (e.g., data exfiltration paths) and drive organizational change to eliminate them, rather than just patching individual issues. * Manage GCP Security Posture: Utilize GCP-native tools (e.g., Security Command Center, Cloud Armor, VPC Service Controls, IAM) to continuously monitor, assess, and improve the security posture of our cloud environment. * Advanced Network & Container Security: Design complex network security controls and Kubernetes (GKE) hardening strategies, balancing strict security requirements with operational velocity. * Mentorship and Technical Sparring: Act as a technical mentor and sparring partner to other engineers. You will elevate engineering standards by guiding colleagues on advanced security concepts and architecture. * Automate Security Operations: Develop advanced automation (using Python, Go, No/Low Code) to eliminate toil, turning manual security reviews into automated policy-as-code checks and high-fidelity alerts. What you bring in: * Technical Experience: Several years of hands-on experience in a senior security engineering role. You have a track record of leading technical designs and influencing decisions across multiple squads. * Security Passion & Threat Awareness: You are passionate about security and stay constantly updated on the evolving threat landscape, emerging vulnerabilities, and attack vectors, translating this knowledge into proactive defense strategies. * Navigating Ambiguity: You excel at breaking down complex, multi-faceted technical problems into actionable components. You are comfortable defining security standards for experimental technologies where internal patterns may not yet exist. * Project Ownership & Grit: Demonstrated ability to drive mid-to-large scale projects from idea to implementation independently, including successful stakeholder alignment and management of external dependencies. * Operational "Doer" Mindset: You are a practitioner who enjoys the craft of engineering. You have recent, deep experience directly configuring infrastructure, writing production-grade code, and debugging complex systems. Once an issue has been identified you have the experience applying the fix either yourself or through collaboration with stakeholders. * Business-Aligned Risk Assessment: Experience weighing risk vs. speed, and making technical decisions that balance short-term delivery with long-term maintainability and business value. * Deep GCP Expertise: Expert-level knowledge of securing cloud infrastructure, with the ability to architect tool-agnostic solutions and evaluate trade-offs in GCP services (GCE, GKE, VPC, IAM, SCC). * Communication: Strong ability to communicate technical security concepts to non-technical stakeholders, clearly articulating business impact (e.g., financial loss, brand reputation) to secure buy-in. What we offer:  We support growth through learning resources, leadership programs, mentoring, and real hands-on work. People can move between teams and projects to build new skills and keep things interesting. We offer clear internal mobility and a transparent path for progression, with leaders who stay involved and provide guidance throughout the year. In addition, you will benefit from:                                                                                                                                                         * A comprehensive compensation package: We offer a competitive salary, 30 days of paid vacation, private health insurance, parental leave top-up, pension, and wellness contributions. * Modern tools to do your best work: Choose your preferred computer and phone within our budget, so you can work comfortably and efficiently. * A people-focused office culture: We value in-person collaboration and follow an office-first model, with some flexibility. Our offices offer a vibrant environment with opportunities to learn, connect, and recharge, from breakfast, lunch, and well-stocked snack stations and quiet spaces to team activities such as movie nights, tech meetups, and cultural events. There's something for everyone. * Truecaller’s “Lab Days” offer a space for imagination: 5 times per year for 3 days, where everyone steps away from their normal tasks to explore new, bold ideas and build things they’ve always wanted to. It’s a space where curiosity leads the way, and prototypes take shape. Some concepts even make it into production, and a few have grown into real features used by millions today. Lab Days allow you to be creative, learn fast, and help shape Truecaller's future. Come as you are: Truecaller is committed to building a diverse and inclusive team. We believe that a wide range of backgrounds, perspectives, and experiences strengthens our products and our culture. No matter where you're from, what language you speak, or how you identify,  we value what makes you unique and would love to get to know you.  Check out Life at Truecaller - Behind the code:  https://www.instagram.com/lifeattruecaller/ Sounds like a great opportunity? We will fill the position as soon as we find the right candidate, so please send your application as soon as possible. As part of the recruitment process, we will conduct a background check. We only accept applications in English.