Cyber Security Lead

<p class="text-muted mb-3">Cyber Security Lead</p>

<ul class="list-unstyled job-desc-list mb-3">

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>£115,000 - £135,000</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>Kings Cross</span></li>

</ul>

<p class="text-muted mb-3">We're hiring a Cyber Security Lead to secure Descrial's product and cloud platform, and to show enterprise buyers that those protections hold up. We handle confidential investment data and our AI agents act on users' behalf, so it matters a great deal who and what can access each piece of data and what each agent is allowed to do.</p>

<p class="text-muted mb-3">You'll own security end to end, from decisions in the code to reassuring clients. The role is roughly 60% hands-on product and cloud security and 40% assurance and client-facing work.</p>

<p class="text-muted mb-3">About Descrial</p>

<p class="text-muted mb-3">Descrial is a startup inside a twenty-year-old company</p>

<p class="text-muted mb-3">TresVista has run the analytical work behind private capital since 2006. 2,000 people, 400+ clients including some of the biggest names in the industry, no outside capital and no outside board. That was the first chapter. And we enjoyed getting here!</p>

<p class="text-muted mb-3">The next chapter is harder and more interesting</p>

<p class="text-muted mb-3">We are moving from services to software, from one firm's workflows to an industry's, and from executing investment decisions to shaping how they get made. Thirty of us in King's Cross, small and senior, with day one founder intensity. At its fullest expression, Descrial changes how every serious investment firm decides.</p>

<p class="text-muted mb-3">The role</p>

<p class="text-muted mb-3">You report to the Head of Engineering, work with the Cloud Architect on AWS security and partner with TresVista's compliance organisation on certification readiness. You make security practical for engineers and credible in client reviews.</p>

<p class="text-muted mb-3">Your remit</p>

<p class="text-muted mb-3">The product and cloud</p>

<p class="text-muted mb-3">You own secure development practices: threat modelling, secure code review, dependency and secrets hygiene, and CI/CD security gates. With the Cloud Architect, you set AWS patterns for IAM, network segmentation, encryption, logging and detection.</p>

<p class="text-muted mb-3">The agent boundaries</p>

<p class="text-muted mb-3">You set defences against prompt injection and data leakage, tool-use guardrails and model-provider risk assessment. You define what an agent may do for a user, how authorisation is scoped by tenant and how actions are attributed and audited. You own AI supply-chain risk, including model and weights provenance, third-party assessments and detecting provider changes or deprecations.</p>

<p class="text-muted mb-3">The evidence</p>

<p class="text-muted mb-3">With TresVista, you drive SOC 2 and ISO 27001 readiness and prepare for ISO 42001 and EU AI Act obligations, owning the technical evidence. You run penetration testing and vulnerability management through scoping, remediation, verification and reporting. Alongside Compliance, you handle client questionnaires, due diligence and security terms in enterprise contracts.</p>

<p class="text-muted mb-3">The operating standard</p>

<p class="text-muted mb-3">You establish security monitoring and incident-response runbooks sized for a scale-up. You help engineers adopt secure practices and keep access and joiner/leaver discipline consistent across London and Bengaluru.</p>

<p class="text-muted mb-3">Your experience</p>

<ul class="list-unstyled job-desc-list mb-3">

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>You have 7+ years in security engineering, including 3+ years securing cloud-native SaaS. AWS experience is strongly preferred.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>You have hands-on secure development and application-security depth, including threat modelling, code-level findings and OWASP.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>You have implemented SOC 2 or ISO 27001 certification programmes and can explain the evidence behind the controls.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>You have worked directly on client security questionnaires, audits or enterprise due diligence.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>You have a degree in engineering, computer science or a related field, or equivalent experience.</span></li>

</ul>

<p class="text-muted mb-3">Useful to have, none required</p>

<ul class="list-unstyled job-desc-list mb-3">

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>CISSP, OSCP, CCSP or comparable certifications</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>Financial-services security or another regulated industry</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>AI/LLM security, including prompt injection, model risk, data boundaries, ISO 42001 or the EU AI Act</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>Experience as an early security hire</span></li>

</ul>

<p class="text-muted mb-3">The reality</p>

<p class="text-muted mb-3">This will be difficult.</p>

<p class="text-muted mb-3">It demands pace and accuracy. We are building autonomous systems inside high-stakes live businesses, where decisions carry real consequences and impact and waiting for everyone to agree is not always an option.</p>

<p class="text-muted mb-3">The systems will sometimes get things wrong. In this phase the London team needs to create the evaluations, visibilities and safeguards that catch mistakes early, reducing them over time and stopping the same failures happening again.</p>

<p class="text-muted mb-3">If you want to build the foundations of an enterprise grade technology platform to service a multi-billion $ serviceable market opportunity, and share in that growth, this is your chance to join us.</p>

<p class="text-muted mb-3">In our conversations</p>

<p class="text-muted mb-3">Come ready to discuss three pieces of work:</p>

<ul class="list-unstyled job-desc-list mb-3">

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>A security boundary you designed: the threat, implementation and evidence that it held.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>A certification or client review you supported: the gaps and how you closed them.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>A vulnerability or incident-response improvement you carried through to verification.</span></li>

</ul>

<p class="text-muted mb-3">Compensation</p>

<p class="text-muted mb-3">The all-inclusive package is typically £115,000–£135,000 a year, depending on experience.</p>

<p class="text-muted mb-3">Practical details</p>

<ul class="list-unstyled job-desc-list mb-3">

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>King's Cross, London. In office (3 to 5 days a week), with colleagues in London and Bengaluru.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>Visa sponsorship is not available for this role.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>We aim to finish the process within three weeks. Tell us if you need an adjustment to the interviews.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>Descrial is an equal opportunity employer.</span></li>

<li class="d-flex align-items-start mb-2"><i class="mdi mdi-circle-medium text-success fs-15 me-2 mt-1"></i><span>Your application will be passed to our screening partner Chooseto.AI</span></li>

</ul>