Principal Information Security & Data Protection Officer

Location: UK Based Remote-first (with monthly travel to London)

At Unmind were here to create better mental health.

We believe mental health should be a source of strength not struggle for people teams and entire organisations.

We combine science technology and human care to help companies like Uber Disney Major League Baseball and the NHS improve mental health and drive performance.

Now were looking for more brilliant people to help us do it.

Our Values

Were building a company where ambition and empathy go hand in hand.

Outpace the rest Move fast. Deliver excellence.

Stronger together We go further faster together.

Client first We win when our clients win.

Inclusion & Belonging

Were building a place where everyone feels seen heard and supported and where difference is celebrated.

If you need adjustments during the process tell us when you apply or email .

Learn more about how we hire and our commitment to equity in our Candidate FAQ

Working closely with Commercial Engineering Product and Legal to lead Unminds Information Security and Data Protection programmes and act as Unminds designated Data Protection Officer (DPO). We process health information at scale so trust is central to what we offer. Were looking for a hands-on senior individual contributor who can own both disciplines end to end and give the business clear practical advice.

This role sets security and privacy requirements advises and assures.

Overall responsibility for;

Information Security

• the management of Information Security within the business;

• maintaining ISO 27001:2022 and Cyber Essentials certification chairing the ISMS Board and running the ISMS day to day policies risk management controls evidence and internal audits;

• liaising with Engineering Product and Data & AI on information security threats and vulnerabilities and recommending mitigations;

• Information Security incident management and remediation;

• managing the Application and Infrastructure penetration testing and vulnerability management process tracking findings to closure;

• leading AI governance operations including the AI policy and register AI use-case risk reviews and readiness for ISO 42001;

• managing the Information Security pre-sales RFP and contractual process and keeping trust materials in Conveyor current;

• managing the businesss security education and awareness training programme;

• reporting information security compliance and risk to ELT and the Board.

Data Protection Officer

• performing the statutory duties of the DPO under UK and EU GDPR including acting as the contact point for the ICO and other data protection authorities;

• maintaining Unminds privacy framework including privacy notices and retention;

• advising on privacy for new products suppliers and AI use cases including coordinating DPIAs;

• managing data subject rights requests and personal data breach assessments;

• leading privacy review of DPAs and client assurance with Legal and Commercial and reporting data protection risk to ELT and the Board.

We know great people come from all sorts of backgrounds and we want to make sure were focusing on what really matters. We welcome applications from people with different experiences and perspectives while recognising that certain qualifications are essential for this role. Youll find these outlined below.

ESSENTIAL:

• Experience of implementing and maintaining ISO 27001 certification within a global technology business;

• Expert practical knowledge of UK and EU GDPR including DPIAs rights requests personal data breaches and international transfers;

• Experience acting as or working closely alongside a Data Protection Officer;

• Confident client-facing presence able to explain Unminds data security and privacy approach clearly to prospective and existing clients;

• Experience advising engineering and product teams on mitigation solutions for application and infrastructure security risks;

• Sound understanding of AI-related security and privacy risks;

• Ability to give clear independent advice and challenge to senior leaders;

• Commitment and attention to detail;

• Able to manage multiple competing requests across the business prioritising by risk and deadline;

• Excellent verbal and written communication skills;

• Credible and behaves with the highest levels of integrity.

DESIRED:

• Experience with health or other special category data or digital wellbeing products;

• Experience in a high growth business environment;

• Familiarity with ISO 27701 and ISO 42001;

• A recognised security or privacy certification (such as CISSP CISM CIPP/E or CIPM) or equivalent practical experience.

Tip for candidates: If youre unsure whether to apply do. We know great people dont always tick every box.

We believe wellbeing and performance go hand-in-hand and we build our environment to support both.

A few highlights:

Private medical for you & your family

Equity in Unmind

Generous gender-neutral parental leave

25 days holiday birthday celebration days

Revive & Thrive Days company-wide Friday off monthly

Flexible working early Friday summers

Remote-first within the UK with monthly in-person meet-ups and access to a London co-working space

Annual learning budget learning leave

Free weekly therapy or coaching sessions

Wellbeing support via WellHub & Bippit

See all benefits on our Careers Page

Required Experience:

Staff IC