Enter a job title or keyword
Head of Information Security
Job Location:
Monthly Salary:
Posted:
21 May 2026 (30+ days ago)
Posted:
Application Deadline:
19 November 2026
Application Deadline:
Vacancies:
1 Vacancy
Vacancies:
Job Summary
MOO brings brands to life in a sustainable way with a range of remarkable print and merchandise products. We combine design technology manufacturing and service so that people can connect in memorable ways. Not online but out there in real life.
We started in 2004. Since then weve built an award-winning and much-loved brand with customer satisfaction and Trustpilot ratings that make most businesses want to give up and hire an army of review bots. Weve got half a million customers mostly small and medium businesses in North America the UK and Europe businesses that like us get all excited about putting something real and beautiful into peoples hands. Does that make us nerds Probably and were ok with that.
Weve been given the highest business award in Britain The Queens Award for Enterprise. Backed by venture capital were part of Tech Nations Future Fifty recently passing $1bn in lifetime revenue and featuring in the Guardians top 10 UK start-ups list. Ok well stop bragging now.
Today were more than 400 people with our global HQ in London UK while we also have premises in the US youll find us in Boston MA as well as East Providence RI and Denver CO and with our most recent office expansion in Cape Town South Africa.
MOO is seeking an experienced Head of Information Security to review and re-build our security privacy and resilience capabilities from the ground up and in the first 12 months to act as build lead for the digital and security aspects of a company-wide Business Continuity Disaster Recovery and Incident Response programme.
This is a standalone role reporting to the Head of Legal It is not a caretaker or compliance-only position. You will operate as a hands-on builder defining strategy establishing governance writing playbooks and directly influencing Engineerings roadmap and delivery practices to embed security privacy and resilience by design.
The Person We Want
Were looking for a hands-on builder with a proven track record of building security privacy and resilience programmes from the ground up.
Youll be comfortable working with executive and board level while also getting into the details of security incident response business continuity disaster recovery cloud security and data privacy.
Youll be pragmatic and business-focused balancing security with delivery velocity and availability and have a collaborative mindset as a partner not an auditor or advisor.
Responsibilities
Strategic Security Leadership & Governance
- Define and own information security strategy aligned with business objectives.
- Establish security governance framework including policies standards risk management and risk appetite.
- Chair the Security Governance Forum and run a board-level reporting cadence.
- Build a security roadmap prioritising compliance privacy AppSec and resilience.
- Hold explicit authority to gate Engineering roadmap and release decisions on security and resilience grounds.
- Drive adoption of UK Cyber Essentials across the business and CIS AWS Foundations for the Platform.
- Stand up centralised monitoring and alerting across Security Hub and Wiz.
Incident Response Business Continuity & Disaster Recovery
- Own and continuously improve the security incident response plan and playbooks; act as incident commander when needed.
- Create and maintain the Business Impact Analysis (BIA) and risk assessments to inform continuity strategies covering cyber scenarios.
- Define and maintain DR strategy architectures and playbooks to meet RTO/RPO targets for in-scope services.
- Design and own the data recovery strategy and identity recovery strategy.
- Establish backup restore and failover testing cadence with evidence of success criteria.
- Lead security incident crisis management including cross-functional command structure executive communications customer and regulator notifications liaison with the cyber insurer/broker and after-action reviews.
- Plan facilitate and participate directly in tabletop cyber exercises and live cyber simulations at least quarterly.
- For any incident classified Severity 1 or 2 act as deputy incident decision-maker holding delegated authority from the CFO to make time-critical operational decisions.
Data Privacy & Regulatory
- Partner with Legal to own the GDPR programme end-to-end from an information security perspective including DPIAs ROPA DSR handling consent and lawful basis.
- Partner with Legal to maintain DPAs SCCs and appropriate transfer mechanisms for third countries.
- Implement data classification and protection standards across structured and unstructured data.
- Embed Privacy by Design and data minimisation into discovery design and delivery processes.
- Own the roadmap towards enterprise assurance frameworks including UK Cyber Essentials and SOC 2 readiness.
- Prepare for external audits and assessments and ensure customer security questionnaire responses reflect actual control status.
Third-Party & Cloud Security
- Establish and run the vendor risk management programme with pre-procurement security gates continuous monitoring SLAs and breach flow-down obligations.
- Maintain a current inventory of third-party access and dependencies including each vendors own DR/BC posture.
- Drive cloud security posture management and foundational controls including IAM network segmentation encryption and secrets.
- Partner with Technology to eliminate shadow technology and tighten ownership/authorisation.
About You
- 6 years in information security with 3 years of direct exposure to executive and board-level security reporting.
- Proven track record building security privacy and resilience programmes from the ground up including authoring a companys first Business Continuity Plan for information security.
- Demonstrated experience running a Business Impact Analysis and translating it into a defensible Minimum Viable Company / recovery-tier model.
- Expertise in GDPR and PCI-DSS with hands-on ownership of DPIAs DSRs and retention programmes.
- Experience leading security incident response business continuity disaster recovery and crisis exercises.
- Solid grasp of cloud security.
- Strong understanding of e-commerce security (payments customer data).
- Excellent executive communication able to brief the CFO and the Board directly and to hold the security incident-decision-maker role with credibility under pressure.
- Strong stakeholder management across Engineering Product Legal Finance and Operations with the standing to influence Engineering roadmap decisions.
- Pragmatic and business-focused balancing security with delivery velocity and availability.
- Collaborative mindset: a partner not an auditor or advisor.
Nice to Haves
- Experience with physical/production continuity planning.
- AWS experience.
- Working knowledge of UK Cyber Essentials and CIS AWS Foundations.
- Experience driving DR maturity and recurring cross-functional simulations.
- Experience with SOC 2 readiness.
Whats it like to work at MOO
MOOs the kind of workplace where you can really be yourself. Dye your hair purple. Hit the sofa with your laptop. Whatever helps you feel comfortable and happy at work. We want to help you grow in your career and set you up for success while also recognising the importance of a healthy work/life balance.
Thats why we offer 25 days holiday rising by one day for each year here (for 5 years) a matched pension scheme and paid parental leave. Well offer you private healthcare life insurance a season ticket loan and a cycle to work scheme. We also offer flexible work schedules with hybrid and remote working for certain roles as well as a Work From Anywhere program.
Diversity Statement
We are working hard to create a representative inclusive and super-friendly team because we know that different experiences perspectives and backgrounds make for a better workplace. And that creates a better experience for our customers. MOO doesnt discriminate on the basis of race colour religion or belief gender national origin age sexual orientation marital status disability or any other protected class.
As a design and technology company we have a desire and a responsibility to build a business that represents the world around us. So we strive to create a values-driven purposeful and highly empowered organisation that we are all proud to work for. And we are committed to continuous investment in building an open and inclusive environment welcoming a diverse audience of candidates who see themselves working and thriving at MOO. Therefore wed like to invite you to complete this optional survey to help us evaluate our inclusion and diversity efforts. Completing this form is entirely voluntary and if you decide not to it wont in any way affect your job application. We keep the information separate from your application and it is kept secure and confidential it is only used to better our inclusion and diversity submitting this information you consent to MOOs processing of it for these purposes.
We may use artificial intelligence (AI) tools to support parts of the hiring process such as reviewing applications analyzing resumes or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed please contact us.
Required Experience:
Director
About Company
Online printing services to create high-quality business cards, stickers, postcards, and more. Professional custom printing by MOO, the best online print shop.
