Head of Information Security
- Compensation
- Not disclosed
- Location
- London, United Kingdom
- Work setup
- Hybrid
- Seniority
- C level
- Employment
- Not specified
- Experience
- 2+ years
- Category
- Security
- Posted
Skills
Must have
- Own Company Security: Define and lead the information security strategy, roadmap, and governance framework aligned to our NIST-based security framework. Lead incident response, vulnerability managemen
- Drive Security Strategy & Vision: Build and evolve a scalable security architecture across cloud infrastructure, application, and network layers. Translate the threat landscape into actionable initiat
- Lead & Scale the Team: Manage and develop a multi-disciplinary security function spanning GRC and cybersecurity engineering. Build hiring plans, establish clear priorities, mentor team members, and ac
- Cross-Functional Collaboration: Serve as the primary security interface with Engineering, Product, Legal, Compliance, Finance, and People teams. Support product teams on security implications (includi
- Process, Quality, & Compliance: Drive observable security through meaningful metrics, structured incident logging, and smart alerting. Contribute to executive risk reporting, risk register management,
- Track Key Success Metrics: Deliver strong performance across security incident rates, mean time to detection/recovery, clean SOC 2/PCI-DSS/FCA audits, SLA remediation times, team engagement, and compa
Full description
GoHenry is a UK-based fintech company created by parents to pioneer financial education. More recently, GoHenry moved into Europe and the US by joining forces with French fintech company PixPay and US investing app, Acorns.
Together, Acorns, PixPay, and GoHenry have over 6 million members across 5 countries. We are focused on empowering families with engaging money management tools, educational content, and a seamless product experience that creates financial well-being from birth to adulthood.
We are looking for a Head of Information Security reporting to the VP of Engineering to own GoHenry's security posture end-to-end. GoHenry serves children and families; protecting their data and money is central to our product promise and regulatory obligations (UK Children's Code, PCI-DSS, FCA Consumer Duty, SOC 2, and UK GDPR). In this senior leadership role, you will build and scale a high-performing team spanning information security, cybersecurity, and IT, embedding a culture where security is a first-class concern across the organisation.
Responsibilities
- Proven leadership experience scaling a security function across information security, GRC, and cybersecurity engineering.
- Strong technical grounding in cloud, application, and network security, with a track record of collaborating directly with engineering teams.
- Direct experience owning compliance, audit programmes, and AI security governance frameworks (including familiarity with the EU AI Act and UK AI frameworks).
- Background in a fast-moving, product-led technology business—ideally within regulated fintech or platforms serving children and families.
- Ability to translate complex security risks into clear, business-relevant language for non-technical leadership and board-level stakeholders.
- A thoughtful, supportive approach to people management, mentoring, and team development.
- Comfort with ambiguity, defining strategic problems from scratch, and bringing teams along with you.
Requirements
- Own Company Security: Define and lead the information security strategy, roadmap, and governance framework aligned to our NIST-based security framework. Lead incident response, vulnerability management, penetration testing, cloud/application/IT security, and identity and access management. Maintain SOC 2 Type II, PCI-DSS Level 1, and FCA compliance audit readiness.
- Drive Security Strategy & Vision: Build and evolve a scalable security architecture across cloud infrastructure, application, and network layers. Translate the threat landscape into actionable initiatives for the team and clear context for the board. Own the AI security governance framework and proactively adapt to evolving regulatory environments.
- Lead & Scale the Team: Manage and develop a multi-disciplinary security function spanning GRC and cybersecurity engineering. Build hiring plans, establish clear priorities, mentor team members, and act as a calm, decisive leader during high-pressure moments.