Job Title: Information Security & Governance Lead

OB Collective is a UK technology business working on independent verification, data integrity, and evidence for information moving between organisations and systems. We work primarily across government and regulated environments, combining software engineering, architecture, and assurance to help organisations understand and control information before it is relied upon.

We are looking for an experienced Information Security & Governance Lead to join an initial five-month technical programme focused on secure data integration across UK policing environments.

The programme will explore how authorised operational information can be exposed and exchanged consistently between organisations while source systems remain under local control. The work includes identity and access, policy enforcement, data provenance, local and national service boundaries, integration resilience, and the controls needed to move from Alpha into future operational use.

You will work alongside solution architects, software engineers, data specialists, and policing stakeholders. Your role is to make sure security and information-governance requirements are designed into the technical architecture rather than applied retrospectively.

The role is UK-based, outside IR35, and primarily remote, with occasional travel for force workshops, architecture sessions, and project reviews.

Current SC and NPPV3 are required.

Responsibilities

• Own the security and information-governance workstream across the programme.
• Develop and maintain the threat model and security architecture.
• Translate policing information-governance requirements into practical technical controls.
• Advise on authentication, authorisation, policy enforcement, and identity-context propagation.
• Define security requirements for local data integration services, APIs, and service-to-service communication.
• Support DPIA, information-governance, and data-processing assessments.
• Assess controls around OFFICIAL and OFFICIAL-SENSITIVE policing information.
• Work with technical leads on encryption, secrets, credentials, audit, logging, and evidence handling.
• Define how policy decisions and access decisions should be recorded and reconstructed.
• Assess data-retention, deletion, freshness, and local-replication implications.
• Support Security Aspects Letter interpretation and any associated security actions.
• Review risks around privileged access, malicious or malformed data, replay, source-system overload, and configuration change.
• Ensure security considerations are reflected in test scenarios and acceptance criteria.
• Define security and accreditation actions that would need to be completed during a subsequent Beta or production phase.
• Work directly with police-force security, information-assurance, and information-governance stakeholders where required.