IT Security & Compliance Manager

Job Description

About Scrumconnect Consulting

Scrumconnect Consulting is a multi-award-winning digital consultancy, recognised for delivering impactful technology solutions across UK government departments. Our work has positively influenced the lives of over 40 million UK citizens. With a strong commitment to user-centred design and agile delivery, and more to deliver innovative digital services that matter.

The Role

Scrumconnect delivers digital services to HMRC, DWP, DfE, DVLA, the Home Office, MOJ and the NHS.

That work depends on us proving we are certified, secure and compliant. You will be the person who makes sure we can.

You will maintain our ISO certifications, run IT security and compliance operations, and manage a laptop estate growing from 400 to 500+ devices. You will report to the Operations Manager, with a dotted line to the Head of People and Culture.

We are hiring because this work has outgrown being done on the side. We want one accountable owner who finds the gaps before an auditor or a client does.

This is a hands-on, single-person role, not a SOC or team-leadership position and Reports to Operations Manager

What You Will Do

• Own our ISO certifications: Maintain our existing ISO 27001, 9001, 14001 and 20000-1 certifications. Run internal audits, management reviews and external audits to ensure we remain certified throughout the year.

• Keep us eligible for government work: Keep Cyber Essentials, Cyber Essentials Plus and every other certification we hold current, and lead any new certifications we take on. Manage the annual ITHC and penetration test, and close every finding.

• Run compliance operations: Track ICO and UK GDPR requirements, WEEE and e-waste disposal, and contractual and legal obligations, ensuring nothing is discovered for the first time during an audit.

• Find and close gaps: Run gap assessments and risk reviews across systems, devices, SaaS and suppliers, and keep the risk register and corrective actions up to date.

• Run day-to-day security: Manage endpoint protection, patching, MFA, access reviews for joiners, movers and leavers, and incident response.

• Own the laptop estate: Manage every device from purchase to disposal, ensuring the asset register is reconciled with HR headcount so we can account for every device.

• Build awareness and client trust: Run induction sessions and phishing simulations, answer client security questionnaires, test the BC/DR plan, and report monthly to leadership.

What We Are Looking For
Essential

• Two or more years of experience in an IT security or IT compliance role where you were the main person responsible for the work.

• Hands-on experience with ISO 27001 audits and Cyber Essentials and Cyber Essentials Plus.

• Practical administration experience with Google Workspace or Microsoft 365, an MDM platform (Intune, Jamf or similar), and endpoint protection.

• Ability to write clear policies and explain them to non-technical colleagues.

• Eligibility for Security Check (SC) clearance, as some of our government work requires it.

Desirable

We can support you in developing these skills and areas of knowledge.

• ISO 27001, ISO 9001, ISO 14001 or ISO 20000-1 Lead Implementer or Lead Auditor qualifications, CISMP or Security+.

• Knowledge of UK public-sector security expectations, including NCSC guidance, ITHC and departmental supplier assurance.

• Knowledge of UK GDPR and ICO obligations, SOC 2 or supplier risk management.

• Knowledge of Home Office sponsor-licence compliance from the IT and asset management perspective.

We are not looking for a SOC analyst or a penetration tester. We want an organised, practical person who can keep a growing consultancy certified, secure and audit-ready.

What Success Looks Like in Year One

• Every certification renewed on time with no major non-conformities, and any new certification taken on this year achieved.

• A gap assessment completed, with a remediation plan agreed and the top risks closed.

• Every laptop enrolled in MDM, encrypted and reconciled with HR headcount, with leaver devices recovered within five working days.

• Client security questionnaires completed within every bid deadline, supported by a reusable evidence pack.

• A monthly security and compliance report that leadership trusts.

Location: Staines-upon-Thames (hybrid), with occasional travel to Newcastle and Edinburgh. 

Our Commitment to Diversity & Inclusion

At Scrumconnect Consulting, we believe that diversity drives innovation. We are committed to creating an inclusive environment where everyone is respected, valued, and supported. We actively encourage applications from women, people with disabilities, individuals from under-represented communities, and those seeking flexible working arrangements.

As a Disability Confident Level 1 employer, we provide reasonable adjustments throughout the recruitment process and employment to ensure equal opportunity for all.