GRC Security Specialist

We’re redefining consumer lending in the UK, and beyond. Using advanced AI and Open Banking data, we make fair, affordable personal finance available to more people. While traditional lenders rely almost entirely on credit scores, we look at the full financial picture - how much you spend, and what you can afford to repay to build a deeper, more accurate understanding of each customer's unique financial situation.

And we've shown it works at scale. We’ve issued over £1.3bn in loans directly to customers while delivering market-leading credit performance - for every 10 defaults the industry expects, we see only 3. We also reached profitability just 2.5 years after launch.

Backed by £2bn+ of funding from top-tier investors including Citi, GSR Ventures, and Deutsche Bank, we’re recognised as one of Europe’s fastest-growing fintechs (Sifted, CNBC). Now, we’re expanding into new markets and product lines - and we’re looking for ambitious people who want to learn fast, take ownership, and grow with us.

We are formalising our security assurance function. We have technical controls and the engineering culture; what we need now is the governance layer that proves it - to our auditors, to our funders, and to our regulator.

You will be the delivery engine behind that. You will own the recurring assurance cycle end to end, run our third-party security programme, and be the person who turns evidence into something a due diligence team or a certification auditor can be satisfied by.

You will be responsible for building controls, gathering evidence, and challenging suppliers.

1. Third-party security assurance

2. Inbound due diligence and customer assurance

3. The assurance calendar

4. Risk and control administration

5. Vulnerability and findings management

6. Security awareness

First 90 days: you know our supplier estate and have tiered it; the assurance calendar for the next 12 months is published and owned; inbound due diligence requests come to you and go out without the Head of Security rewriting them.

Six months: the trust pack exists and is being used; the risk register is live with owned treatment plans; ISO 27001 evidence collection is systematic rather than a scramble; the exception register exists.

Twelve months: supplier re-assessment runs on a cadence without prompting; the material third party register is ready ahead of the March 2027 deadline; MI to the Risk Committee is trusted.

• Three or more years in an information security assurance, GRC or security compliance role, at least some of it in a regulated financial services environment or another environment with real external audit pressure.
• Hands-on experience of ISO 27001, whether operating an ISMS or taking one through certification.
• Demonstrable experience running third-party or vendor security assessments, and of responding to inbound security due diligence.
• Comfortable reading technical findings — an EDR vulnerability report, a penetration test finding, a cloud misconfiguration — and forming your own view on severity and real-world exploitability rather than passing the vendor's rating through unchanged.
• Clear, concise written English. Much of this role is writing things that external parties will judge us on.
• The confidence to chase a busy engineer, challenge a supplier's assertion, and tell us when an answer is not good enough.
• Experience of a cloud-native environment, ideally AWS.
• Experience of scaling a control framework as an organisation grows.
• Familiarity with UK operational resilience expectations (SYSC 15A) and outsourcing requirements (SYSC 8).
• Certifications such as CISM, CISA, ISO 27001 Lead Implementer or Lead Auditor, CRISC or CCSP. We care more about what you have done than what you hold.

• Everyone owns a piece of the company - equity
• Hybrid with 3 days a week in the office
• 25 days’ holiday a year, plus 8 bank holidays
• 2 paid volunteering days per year
• One month paid sabbatical after 4 years
• Employee loan
• Free gym membership through WellHub
• Team wellness budget to be active together - set up a yoga class, a tennis lesson or go bouldering