Acorn Compliance
Information Security Lead & ISMS Manager
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
About Acorn Compliance
We help healthtech companies get their products into the hands of those who need them most.
Compliance is what gets good health technology into the NHS, into hospitals, into markets that won't buy without it: DTAC, Medical Device Regulations, ISO 13485, all are frameworks that help build trust and are the foundation of safe digital healthcare. We help healthtech companies navigate the path to the certifications required, and we stand behind our work with a warranty.
We work with clients from pre-revenue SaMD startups to global medical device manufacturers. Our team brings over fifty years of combined compliance and regulatory experience, with backgrounds spanning NHSX, Apple and the regulated medical device sector.
Our platform, Squirrel™, does the heavy lifting. Our specialists bring the judgement. And we’re now looking for a talented individual who is passionate about healthcare to join us.
The Role
This role combines two core responsibilities:
- Owning Acorn’s internal ISMS
- Providing security assurance to clients
You will assess whether security evidence actually meets required controls across multiple frameworks. This requires judgement, not checklist validation.
You will also act as ISMS Manager, maintaining and developing our ISO 27001-certified management system.
This combination ensures your work is grounded in real implementation while maintaining consistent standards across clients.
Key Responsibilities
Internal ISMS Ownership
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
- Maintain and develop ISO 27001 ISMS (scope, SoA, risk register, treatment plans)
- Lead internal audits and manage external certification audits
- Own Cyber Essentials Plus certification and renewal
- Maintain policies, registers and security documentation
- Lead incident response and post-incident reviews
- Report on security posture and risks
Client Security Assurance
- Review client evidence across ISO 27001, SOC 2, DTAC, DSPT and Cyber Essentials
- Determine whether controls are met, partially met, or not met
- Provide clear, actionable feedback and remediation guidance
- Apply consistent standards across all clients
Cyber Essentials & CE Plus
- Support clients through readiness, submission and certification
- Prepare for CE Plus validation
- Advise on remediation
- Manage certification renewals
Penetration Testing
- Scope and manage testing engagements
- Work with external testing providers
- Translate findings into prioritised actions
- Oversee remediation and retesting
ISO 27001 Delivery (Client Work)
- Lead internal audits
- Support SoA and risk treatment planning
- Prepare clients for certification
- Advise on control implementation
Client Engagement
- Act as named security contact for clients
- Communicate clearly with technical and non-technical stakeholders
- Contribute to DTAC and DSPT submissions
- Identify recurring gaps and improve internal standards
Requirements
Essential
- ISO 27001 Lead Auditor certification
- At least 3 years’ experience in an IT or cyber security role within the last 5 years
- Demonstrable experience delivering Cyber Essentials and Cyber Essentials Plus
- Experience running or supporting an ISMS through certification and audits
- Experience managing penetration testing engagements
- Ability to assess security evidence and make defensible decisions
- Strong understanding of core security controls
- Ability to communicate clearly with non-technical stakeholders
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Preferred
- CISSP (ISC²)
- CISM (ISACA)
- CCP (NCSC scheme – SIRA/Auditor/Architect)
- UK Cyber Security Council (Practitioner or Chartered)
- Cyber Essentials Assessor qualification (or willingness to complete IASME assessor training once hired)
- SOC 2 experience
- NHS DSPT experience
- ISO 27001 Lead Implementer
- Experience in healthtech or regulated environments
- Cloud security (AWS, Azure)
Why join Acorn
- Be part of a team enabling healthtech for the good of all
- Work across multiple frameworks, not just one
- Combine internal ownership + external assurance
- Work with a platform that handles the admin, so your time goes on judgement
- High ownership in a small, senior team
- Direct impact on client delivery and product development
To Apply
Send your CV and a short note to info@acorncompliance.com (or message directly).
In your note, describe a time you rejected security evidence that did not meet a control, and how you handled it.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location