Principal Information Security & Data Protection Officer

Job description

Location: UK Based, Remote-first (with monthly travel to London) At Unmind, we're here to create better mental health. We believe mental health should be a source of strength, not struggle – for people, teams, and entire organisations. We combine science, technology, and human care to help companies like Uber, Disney, Major League Baseball, and the NHS improve mental health and drive performance. Now we’re looking for more brilliant people to help us do it. 🚀 Our Values We’re building a company where ambition and empathy go hand in hand. Outpace the rest – Move fast. Deliver excellence. Stronger together – We go further, faster, together. Client first – We win, when our clients win. 🌈 Inclusion & Belonging We’re building a place where everyone feels seen, heard, and supported – and where difference is celebrated. If you need adjustments during the process, tell us when you apply or email Learn more about how we hire and our commitment to equity in our Candidate FAQ → 🎯 The Role — Principal Information Security & Data Protection Officer Working closely with Commercial, Engineering, Product and Legal to lead Unmind's Information Security and Data Protection programmes and act as Unmind's designated Data Protection Officer (DPO). We process health information at scale, so trust is central to what we offer. We're looking for a hands-on, senior individual contributor who can own both disciplines end to end and give the business clear, practical advice. This role sets security and privacy requirements, advises and assures. Overall responsibility for; Information Security the management of Information Security within the business; maintaining ISO 27001:2022 and Cyber Essentials certification, chairing the ISMS Board and running the ISMS day to day – policies, risk management, controls, evidence and internal audits; liaising with Engineering, Product and Data & AI on information security threats and vulnerabilities and recommending mitigations; Information Security incident management and remediation; managing the Application and Infrastructure penetration testing and vulnerability management process, tracking findings to closure; leading AI governance operations, including the AI policy and register, AI use-case risk reviews and readiness for ISO 42001; managing the Information Security pre-sales, RFP and contractual process, and keeping trust materials in Conv…