IT Security & Compliance Lead (London, UK)

This is a Full-Time Role (40 hours per week, 5DWW) with no option for part-time work. While this is a remote-first opportunity, the candidate filling this role must be a resident of the Netherlands or in the U.K. at the start of employment. Additionally, they must be within commuting distance of our office in Amsterdam or London.
Please visit our Careers page to review all opportunities and submit your application for the role(s) that best fit your location and work authorization. This job ad will close automatically at 9:00AM EST on October 27th.
About the Team
The Technology & Data portfolio, provides the digital infrastructure, engineering and data capabilities that enable effective delivery, innovation and learning across the B Lab Global Network. It brings together four groups: Technology & Data Leadership, Product & Platform Engineering, Data & AI, and Infrastructure & Information Management.
Infrastructure & Information Management (Operational Technology) is responsible for information security, workforce enablement and the adoption of digital tools across the network. It ensures resilience through secure, reliable infrastructure, and manages hosting, networks, access and incident response. The team is evolving from a function that supported a relatively uniform, single-organization tech stack of approximately 150 users into a globally coordinated department supporting approximately 500 users across a broad range of regions, time zones, languages, technical maturity levels and operational practices. As B Lab consolidates multiple historically independent organizations into a unified operating model through the network transformation, Op Tech is adding regional IT support coverage (US & Canada, Europe, UK, Latin America, APAC & AANZ, with shared coverage for Africa) and dedicated security ownership, while keeping centralized governance, platform ownership and alignment of internal technology initiatives.
About the Opportunity
B Lab is seeking an IT Security & Compliance Lead to own security governance across the global network. Consolidation increases security exposure as organizations with different controls come together, and this role exists to set a consistent baseline and raise our security posture proactively rather than reactively.
The Lead conducts security audits and risk assessments, sets and enforces baseline security standards, maintains our information security policy set, coordinates incident response, and supports data protection compliance in the jurisdictions where B Lab operates. Working closely with the Senior Manager of Infrastructure & Information Management, the Regional IT Administrators, and the product, engineering and data teams (including the Data Governance Lead), this role drives consistent security maturity across the network's systems and helps people across the network work securely.
Core Responsibilities
Security Governance, Audits, and Assessments
Conduct regular security audits and risk assessments of network systems, applications and processes, and maintain a prioritized risk register
Establish and maintain a security baseline across the network, aligned to a recognized framework (for example ISO/IEC 27001:2022)
Track and report security posture and maturity over time to the Technology leadership team, with clear metrics
Run security reviews of new and existing vendors and technology platforms (third-party risk), including SaaS tools used by regional and market teams
Coordinate external penetration testing and vulnerability scanning, and track remediation with system owners
Identity, access and platform security
Define and monitor access control standards (MFA, SSO, least privilege, joiner/mover/leaver processes) across core platforms such as Google Workspace and Salesforce
Partner with Regional IT Administrators on endpoint and device security standards for a distributed, remote-first workforce, moving toward a zero-trust model
Advise Product & Platform Engineering on secure-by-design practices for B Lab's digital
Security policy development and awareness
Own and maintain the information security policy set (including the Information Security, Backup & Recovery and Security Incident Management policies) and the standards and procedures that support it
Refine policies as the network consolidates, and communicate changes clearly to staff across regions and languages
Own the network-wide security awareness program (KnowBe4), including training, phishing simulations and completion reporting
Contribute the security perspective to the B Lab AI Policy and to the safe adoption of AI tools
Incident response and resilience
Own and maintain the incident response plan, covering detection, escalation, containment, communication and post-incident review
Serve as lead coordinator during security incidents, working with Legal, Communications and affected regions
Support business continuity and disaster recovery planning, including testing backup and recovery procedures
Compliance and risk management support
Support data protection compliance across the regions where B Lab operates (for example GDPR, UK GDPR and Brazil's LGPD), in partnership with Legal and the Data Governance Lead
Partner with Legal, HR, Finance and other teams on compliance matters, such as data processing agreements, data subject requests and breach notification
Maintain documentation and evidence that supports audits, partner and funder due diligence, and regulatory inquiries
About You
3+ years of experience in information security, IT governance, risk and compliance (GRC), or a closely related field
Strong understanding of networking concepts, cybersecurity, and implementing best practices to ensure compliance with data and regulatory tech laws.
Strong understanding of at least one recognized cybersecurity framework
Experience conducting security audits, risk assessments and vendor security reviews
Working knowledge of data protection regulations relevant to a global organization (for example GDPR, LGPD)
Experience developing or maintaining incident response and business continuity plans
Hands-on familiarity with cloud and SaaS security, especially Google Workspace administration and identity and access management
Ability to explain security risk in plain language to non-technical colleagues, and to write clear policies
In your application, please note any additional experiences, platform competencies or technical skills that you believe are relevant to your preparedness for this role.
The following is not strictly required but would allow you to thrive in this role:
Experience in a nonprofit, federated or multi-entity organization, or in integrating security controls after a merger or consolidation
Experience with Salesforce security, security awareness platforms (such as KnowBe4), or endpoint management tools