Cyber Security Lead - Edinburgh

Security & Assurance Lead | £70,000–£80,000 | Edinburgh (Hybrid)

Location: Edinburgh, Leith (2 days per week in the office)

Salary: £70,000–£80,000

Contract: Permanent, Full-time

Working Pattern: Hybrid

The Opportunity

Harvey Nash is partnering with a fast-growing technology business delivering critical digital infrastructure to the UK public sector to recruit a Security & Assurance Lead.

This is an exciting opportunity to become the organisation's first dedicated security hire, taking full ownership of its cybersecurity strategy, technical security controls and governance framework.

Working directly with the CTO, you'll play a pivotal role in shaping the security function as the business expands across the UK and internationally.

The role offers a unique combination of hands-on cloud security engineering and governance, risk and compliance (GRC), with responsibilities split approximately 50/50 between technical security and assurance.

Key Responsibilities

• Take ownership of the organisation's cybersecurity function, security strategy, policies and controls.
• Lead ISO 27001 and Cyber Essentials Plus certification and ongoing compliance activities.
• Oversee cloud security across an AWS-based serverless environment.
• Manage vulnerability assessments, penetration testing and remediation activities.
• Embed security into development pipelines, including SAST, dependency scanning and secrets management.
• Conduct threat modelling and security risk assessments for new applications, features and integrations.
• Lead security incident response, detection engineering and security monitoring activities.
• Develop and maintain security documentation, risk registers, security playbooks and assurance reporting.
• Work closely with government cybersecurity stakeholders to demonstrate compliance and security assurance.
• Implement AI-assisted security automation to improve monitoring, vulnerability management and compliance evidence gathering.
• Oversee access governance, security awareness and data protection activities.

Skills & Experience Required

• Strong hands-on cybersecurity engineering experience, ideally within AWS cloud environments.
• Proven experience implementing or managing ISO 27001 and/or Cyber Essentials Plus certification.
• Practical experience in vulnerability management, penetration testing coordination and threat modelling.
• Understanding of DevSecOps, CI/CD security and secure software development practices.
• Experience developing security policies, risk assessments and assurance documentation.
• Ability to communicate technical security risks clearly to senior stakeholders and non-technical audiences.
• Experience using AI assistants or automation workflows to improve security processes.
• Comfortable taking ownership of security independently in a growing technology environment.

Desirable Experience

• Knowledge of NCSC guidance and Cloud Security Principles.
• Experience working with public sector organisations or government security assurance teams.
• Familiarity with AWS Lambda, serverless architecture and GitHub Actions.
• SIEM, detection engineering and incident response experience.
• Knowledge of UK GDPR, DPIAs and data protection requirements.
• Certifications such as CISSP, CISM or AWS Certified Security Specialty.

What's on Offer?

• Competitive salary of £70,000–£80,000.
• Hybrid working with just 2 days per week in the Edinburgh office.
• 30 days annual leave plus your birthday off.
• Enhanced parental leave.
• Company pension with employer contributions.
• Dedicated learning and development budget.
• Opportunity to work directly with the CTO and influence technical decision-making.
• Significant autonomy to build and shape the organisation's security function.
• Opportunity to contribute to a growing technology platform supporting critical public services.

Additional Information

Applicants must have the right to work in the UK and be eligible for BPSS clearance.

Interested?

If you're an experienced Security Engineer, Cloud Security Lead, Information Security Manager or Security Consultant looking for an opportunity to take ownership of a security function while remaining technically hands-on, we'd love to hear from you.

Please apply or contact me directly for a confidential discussion.