Information Security Director

Role purpose :

Information Security at Prevalent AI protects the trust our business is built on. Our clients are global banks, insurers, telcos and critical national infrastructure operators who trust us with highly sensitive data, and they expect our own security to match the standard of the cyber security solutions we deliver to them. The function sets the strategy, standards and assurance that keep the company, our platform and our clients’ data secure, while enabling the business to grow with confidence.

As Information Security Director, you will own Prevalent AI’s information security strategy, risk posture and assurance programme, and serve as the company’s acting CISO – the accountable executive for security across our operations globally. Reporting to the COO, you will be a trusted advisor to the leadership team and a senior security voice with client stakeholders, translating complex security risk into clear business decisions. You will lead the security agenda end to end, from governance, policy and certification to secure-by-design engineering, AI governance and incident response, driving measurable risk reduction and making our security posture a visible strength in bids, renewals and client audits.

This is a senior leadership role for someone with executive presence, sound commercial judgement and a track record of building and leading security programmes in complex, regulated enterprise environments. The role is a key member of the Prevalent Senior Leadership team and is pivotal to protecting the company’s reputation, earning client trust and enabling the next phase of growth as our platform and AI capabilities scale.

Key accountabilities :

• Define and own a multi-year information security strategy and roadmap aligned to business, product and client priorities

• Own the information security policy framework and ensure policies are adopted across all functions and jurisdictions, ensuring global compliance

• Lead the security governance forum and report security posture, risks and metrics to the COO and leadership team

• Own the security risk register and risk-acceptance process, translating technical risk into business terms

• Lead certification and audit programmes - e.g. ISO/IEC 27001, SOC 2

• Oversee compliance with data protection and security obligations, working with Legal and the People Team as required

• Manage third-party and supplier security risk, including cloud and AI service providers

• Act as the senior security point of contact for clients, leading security questionnaires, due diligence and client audits

• Partner with Sales and Global Solutions & Services to make our security posture a visible strength in bids and renewals

• Set security architecture principles for the platform and cloud environments (AWS, Azure, GCP) with the CTO and VP Architecture

• Embed secure-by-design and DevSecOps practices across Feature Team Pods and the software development lifecycle

• Establish governance for the secure and responsible use of AI, both in our product and internally

• Own the incident response plan and lead the response to major incidents, including executive and client communications

• Ensure effective threat detection, vulnerability management, VAPT and business continuity and disaster recovery testing

• Build, lead and develop the security team, including line management of the Lead Information Security Engineer

• Own the security budget and make sound build, buy or outsource decisions

• Drive a company-wide security culture through awareness, training and visible leadership, in partnership with the People Team.

Skills and Experience :

• Significant information security experience including leading a security function or programm

• Proven track record of building or maturing a security programme in a high-growth software, SaaS or data company

• Led ISO/IEC 27001 and/or SOC 2 certification or audit cycles end to end

• Strong cloud security knowledge across AWS, Azure and/or GCP, with fluency in secure SDLC and DevSecOps.

• Experience working with enterprise clients in regulated sectors such as financial services, telecoms or critical infrastructure.

• Has led the response to significant security incidents, including executive and client communicatio.

• Commercial judgement: balances risk against business need and enables delivery

• Able to explain technical risk clearly to non-technical leaders and influence without direct authorit

• Experience building, leading and developing high-performing teams.

• Desirable: experience securing AI/ML systems or data platforms, and working across UK and India operations.

Education :

• Bachelor’s/Master’s Degree in Computer Science, Information Security or a related field

• Certifications such as CISSP or CISM expected; CCSP, CISA or ISO 27001 Lead Implementer/Auditor desirable