Information Security Officer

Form3 Group; Greater London; On-site; GBP 60,000 - 80,000; Full time

Job summary

A forward-thinking tech firm in Greater London is seeking an Information Security Officer to enhance its information security governance, risk, and compliance practices. The ideal candidate will have over 5 years of experience in Information Security, expertise in compliance frameworks like ISO27001, and strong communication skills to work collaboratively across various teams. This hands-on role involves monitoring security controls, conducting audits, and supporting the development of policies to protect customers and operations.

Benefits

Positive onboarding experience

Opportunity to impact security governance

Qualifications

• 5+ years’ experience in Information Security, ideally in tech or financial services.
• Hands-on experience with audits and risk assessments.
• Experience leading ISO27001, ISO22301 or SOC 2 certification programs.

Responsibilities

• Apply expert knowledge of security frameworks to support governance.
• Assist in drafting and maintaining Information Security Policies.
• Monitor and report on adherence to security controls across the business.

Skills

Strong knowledge of security frameworks

Excellent communication skills

Analytical mindset

Cloud security understanding

Education

Security-related qualifications like CISSP, CISM, CISA

Tools

GRC tooling

Job description

As an Information Security Officer at Form3, you’ll play a pivotal role in strengthening and evolving our information security governance, risk, and compliance practices. Working within the Information Security team, you’ll help ensure that Form3 continues to operate securely and maintain the trust of our customers and partners.

You’ll work closely with teams across the organisation, from Engineering and Product to Legal and Risk teams, to embed security into business and technology decisions. This is a hands‑on role that combines strategic oversight with practical execution, ensuring our controls, frameworks, and awareness initiatives remain industry leading as we scale globally.

What you’ll do

• Apply expert knowledge of security frameworks and controls such as NIST, ISO22301, ISO27001, ISO27017/18, ISAE3000/SOC2, and GDPR to support security governance.
• Support the development, maintenance, and continual improvement of the ISMS and BCMS.
• Assist in drafting and maintaining Information Security Policies and ensure alignment with business and customer requirements.
• Contribute to the planning and execution of external audits, engaging directly with auditors and customers.
• Monitor and report on adherence to security controls across all areas of the business via risk assessments and internal audits.
• Assess and support the remediation of information security risks, non‑conformities, and issues across systems and services.
• Support vulnerability management processes, from triage and tracking to remediation reporting, in partnership with Offensive Security and Engineering teams.
• Conduct vendor and third‑party security assessments, ensuring suppliers meet Form3’s security and compliance requirements.
• Partner with the Defensive Engineering team to ensure security requirements are built into product developments.
• Deliver and enhance security awareness and training initiatives to promote a strong security culture across Form3.
• Collaborate with the Security Operations team to maintain situational awareness of emerging threats and vulnerabilities, ensuring timely escalation and risk‑based response.

Form3’s Information Security Governance, Risk and Compliance (GRC) team plays a critical role in protecting the organisation, so we’re looking for someone who is analytical, collaborative, and passionate about driving security excellence. You’ll thrive on solving complex problems, balancing deep technical knowledge with strong governance principles, and finding ways to make security scalable across a fast‑moving, cloud‑native business.

• 5+ years’ experience in Information Security, ideally within a fast‑paced technology or financial services industry.
• Strong working knowledge of frameworks such as ISO27001, ISO22301, SOC 1, SOC 2, NIST, and GDPR.
• Proven experience developing, implementing, and improving information security policies, standard­s, and controls aligned to recognised frameworks.
• Hands‑on experience conducting audits, risk assessments, and business impact analyses.
• Hands‑on experience with vulnerability management within a complex and dynamic cloud environment
• Broad understanding of cloud security
• Excellent communication and stakeholder engagement skills, with the confidence to influence at all levels of the organisation.
• Analytical mindset with a focus on continual improvement and measurable outcomes.
• Security‑related qualifications such as CISSP, CISM, CISA, or ISO27001 Lead Implementer/Auditor.
• Experience leading certification and attestation programmes such as ISO27001, ISO22301 or SOC 2
• Experience operating in regulated or high‑availability environments such as financial services, payments, or critical infrastructure.
• Familiarity with GRC tooling and automation to streamline compliance, risk, and control management activities.

This role sits within Form3’s Information Security Governance, Risk and Compliance (GRC) team and reports directly to the Head of GRC. As part of a highly collaborative security function, you’ll play a key role in shaping how Form3 manages information security risk, compliance, and assurance across all areas of the business.

The GRC team underpins Form3’s security standards, designing and maintaining the frameworks, policies, and controls that keep our people, systems, and customers safe. Joining at this stage offers the opportunity to make a significant impact, strengthening governance and compliance across a cloud‑native, environment while helping define how security scales with the business.

Stage 1: Screening Call with Talent Team

Stage 2: Interview with Principal Security Officer

Stage 3: Interview with Head of GRC

We always aim to stick to the above process, however there may be occasions when an additional interview stage is needed for us to be sure we’re hiring the right person!

We are able to accept applications from the UK only.

All new joiners start their first day in our office to collect the equipment needed to work remotely. We’ll also arrange for some of your team to come in to say hi, ensuring you’re supported and have a positive first few days with Form3!

Revolutionising the world of payments with our cutting‑edge technology and innovative solutions. For more information about life at Form3 check out the following pages:

What we do | Life at Form3 | Benefits | Podcasts