The posting
About Hubexo Hubexo is a global construction technology and data company, providing data, insights and software that help businesses across the construction industry work smarter, sell more and build better. As Hubexo continues its transformation and migration towards a more unified operating model, we are looking for an experienced Head of IT Security to lead our security, IT operations and compliance agenda. About the Role As the Head of IT Security, you will own Hubexo's security posture end to end—from day-to-day IT operations and identity management to incident response, third-party risk, penetration testing and compliance. You will be the accountable leader for keeping Hubexo secure, audit-ready and trusted by our customers. This is a hands-on leadership role. You will set the security strategy and roadmap, lead key programmes and work closely with senior stakeholders, while remaining close enough to the detail to lead an incident, challenge a vendor's security controls or review a penetration testing finding. With Hubexo going through a major technology migration, you will also play a critical role in ensuring that new platforms, integrations, SaaS solutions and vendors are securely introduced, assessed and brought into compliance scope. What We're Looking For
8+ years of experience in IT security and/or IT operations, including at least 3 years leading a security or IT function.
Proven experience delivering ISO 27001 certification and/or SOC 2 attestation, including managing external audits.
Hands-on experience with a compliance automation platform, ideally Vanta. Experience with Drata or Secureframe is also relevant.
Proven experience leading security incidents from identification and containment through to resolution and lessons learned.
Experience establishing and managing a vendor or third-party security assessment process.
Experience scoping and managing penetration tests and driving remediation with engineering teams.
Experience managing an outsourced SOC or MDR provider and managing performance against agreed service levels.
Strong working knowledge of Microsoft 365, Entra ID security, endpoint management and cloud environments, particularly AWS or Azure.
Strong communication and stakeholder management skills, with the ability to explain security risks clearly to non-technical audiences and influence across the organisation.
Experience working in a SaaS, technology or data-driven business, ideally within a merger, integration or large-scale platform migration.
Familiarity with securing SaaS platforms and integrations such as HubSpot, NetSuite, Chargebee and Make.com.
Good understanding of UK GDPR and data protection requirements across multiple jurisdictions.
Relevant certifications such as CISSP, CISM, ISO 27001 Lead Implementer or Lead Auditor are advantageous.
Experience with Cyber Essentials Plus or other customer-driven security frameworks is a plus.
What You'll Do Security Leadership & Strategy
Define Hubexo's information security strategy, roadmap and risk management approach.
Report security posture, risks and compliance to senior leadership.
Build security awareness across the organisation and manage security budget, tooling and suppliers.
IT Operations
Lead IT Operations across end-user computing, identity and access management, devices and core infrastructure.
Ensure secure-by-default configurations across Microsoft 365, endpoints, networks and SaaS platforms.
Oversee IT service levels, patching, backup, recovery and secure onboarding of new systems.
Incident Response & Business Continuity
Own incident response plans, playbooks and escalation processes.
Lead security incidents from triage through to resolution, root cause analysis and lessons learned.
Maintain business continuity and disaster recovery plans and coordinate regulatory response where required.
ISO 27001 & SOC 2
Lead ISO 27001 certification and SOC 2 attestation, including audits, controls and remediation.
Own Vanta for compliance monitoring, evidence collection and control management.
Maintain the ISMS and support customer security questionnaires and audits.
Third-Party & Vendor Security
Lead vendor security assessments and review security certifications, reports and questionnaires.
Partner with Procurement and Legal on security and data protection requirements.
Track remediation and risk acceptance for third-party security issues.
Penetration Testing & Vulnerability Management
Own the penetration testing and vulnerability management programmes.
Manage external testing providers and drive remediation with technology teams.
Establish clear remediation priorities and timelines based on risk.
External SOC Partnership
Manage the external SOC provider, including service levels, monitoring coverage and escalations.
Review SOC reporting, improve detection and ensure new systems are appropriately monitored.
Act as the internal escalation point for SOC alerts and incidents.
Why Join Hubexo? This is an opportunity to take ownership of a broad and highly visible security agenda within a global technology business. You will have the opportunity to shape Hubexo's security strategy, strengthen our IT operating model and build security capabilities that support the company's continued transformation and growth. If you're a security leader who enjoys combining strategy with hands-on execution, working across technology and business teams, and building security into a fast-changing environment, we'd love to hear from you.
