Job Description

ABOUT XCEPTOR

Data is at the heart of everything we do: Xceptor has been designed around data manipulation in its broadest sense. We source data from wherever it flows. We curate, normalise, validate, repair, and enrich that data so it reaches its destination in a reliable and consistent format. Data coming out of Xceptor is data our clients can trust.

We are recognised as an expert in the Financial Services vertical, which strongly aligns with Business Users in Middle and Back-Office teams. We enable these users to solve their data challenges by themselves, rather than through a technology-led project.

Our mission - we empower business users within financial institutions to build automated processes that deliver trusted data.

Our values sit at the heart of our business, driving who we are and how we work. At Xceptor, we are:

• Client Centric; we prioritise our Clients’ experience and needs.
• One Team; we actively support one another to achieve our goals.
• Impactful; we focus, we innovate, we make every minute matter.

🚀 Your Role

We’re seeking an experienced, highly independent InfoSec/GRC professional to lead information security across the business and own our ISO/IEC 27001 and SOC 2 programmes end to end.

You’ll be the single accountable owner for audit readiness, evidence quality, stakeholder coordination and continuous improvement, working hands-on without a supporting team.

Beyond compliance, you’ll build an internal culture of security and compliance, manage security incidents, work with the business on vulnerability management, and advise senior leadership on risk.

🧩 What You’ll Be Doing

Security leadership and culture

• Build and champion and information security and compliance culture across the business.
• Advise business and senior leadership on security risks, priorities, and decisions.
• Run periodic information security meetings and maintain governance and reporting: the audit and compliance calendar, risk register, findings tracker, KPIs/KRIs, and regular leadership updates.
• Maintain our information security policies, standards, and procedures.

ISO 27001

• Own and operate the ISMS: scope, risk management, Statement of Applicability, policies and standards, management reviews, corrective actions and continual improvement.
• Plan and manage the internal audit program.
• Lead external certification audits (Stage 1, Stage 2 and surveillance): auditor management, PBC coordination, evidence presentation and remediation closure.

SOC 2

• Own scoping and readiness, and maintain the control matrix, control narratives, evidence catalogue and testing calendar.
• Lead Type I and Type II audits with the CPA firm, ensuring timely, complete, high-quality evidence and responses.

Controls and operations

• Build an integrated control library that minimizes duplication across ISO 27001 and SOC 2 and keep controls “operating in reality”.
• Drive cross-functional control ownership (Engineering, IT, Product, HR, Finance, Legal, Ops) through clear requirements, timelines and follow-up.
• Manage information security incidents, from response through to lessons learned.
• Work with business counterparts on vulnerability management, including prioritization and remediation.

Customer and supplier assurance

• Help with RFPs, security questionnaires, and due diligence packs.
• Support supplier security and evidence sharing aligned to our frameworks.

Customer and supplier assurance

• Help with RFPs, security questionnaires and due diligence packs.
• Support supplier security and evidence sharing aligned to our frameworks.

🎯 Who we're looking for

• 7-10+ years in information security, GRC, risk, or audit/compliance roles.
• Experience in SaaS/technology environments.
• Demonstrable end-to-end ownership of: ISO 27001 certification (not just support), including the internal audit program and management review and SOC 2 audits (Type II strongly preferred).
• Experience managing information security incidents and advising senior stakeholders.
• Proven ability to operate autonomously and drive outcomes without a team.
• A strong evidence-based mindset: you know what auditors look for and how to structure documentation and artefacts accordingly.
• ISO 27001 clause and Annex A control expertise, with internal audit planning and execution.
• SOC 2 Trust Services Criteria experience (control design and operating effectiveness).
• Strong documentation skills (policies, standards, procedures, control narratives).
• Excellent stakeholder management, communication, prioritisation and programme organisation.
• Solid understanding of common security controls (IAM, change management, vulnerability management, logging, incident response, BCP/DR, vendor security).

Preferred Experience

• ISO 27001 Lead Auditor or Lead Implementer, CISSP, CISA, CRISC (or equivalent).
• Experience in modern tooling (Wiz, Drata/Vanta or similar, GRC platforms).

🌍 Diversity & Inclusion at Xceptor

We believe great ideas come from everywhere — and that the best teams are made up of people with different backgrounds, experiences, and perspectives. At Xceptor, we’re committed to building a workplace where everyone feels welcome, valued, and empowered to be themselves.

We know that not everyone ticks every single box in a job description — and that’s okay. If you’re excited about this role and think you could make a difference, we’d love to hear from you. Your unique skills and experiences might be just what we need, even if you don’t meet every requirement.

We celebrate diversity and are dedicated to creating an inclusive environment for all employees — regardless of race, gender identity, sexual orientation, age, disability, religion, or background.

🌗 Hybrid at Xceptor

We love the buzz of the office and the flexibility of home—so at Xceptor, you get the best of both. Our people spend 2-3 days per week in the office collaborating, brainstorming, and connecting in person. The rest is up to you. It’s all about great teamwork, balanced with the freedom to work your way.

#LI-GL1

#LI-Hybrid

Please note:

• Xceptor works with clients in financial services and our offers of employment are subject to the satisfactory completion of background checks, which includes criminal record checks, and credit reference checks.
• If you have any employment gaps exceeding three months within the last six years, we will request additional information and evidence to clarify those periods.