VP of Security & Infrastructure

Flo is the world’s #1 health & fitness app worldwide focused on female health, backed by a $200M investment and valued at $1B in 2024. The company has 7M paid subscribers and 80M+ monthly active users, holding ISO 27001 and ISO 27701 certifications. Задачи: — Develop, evolve and communicate Flo’s security strategy and roadmap, promoting a strong shared security ownership culture. — Oversee all aspects of Flo’s security programme, risk management, security architecture, product security, and security operations, including embedded security engineering functions. — Define and enforce standards for storing, protecting, and deleting personal and health data across production systems, analytics warehouses, AI model training sets, backups, and search indexes. — Deliver and oversee technical controls, automated evidence extraction, and ongoing compliance for ISO 27001, ISO 27701, SOC 2 Type 2, HIPAA, EU AI Act, and Cyber Resilience Act. — Establish evaluation criteria and governance controls for vendors, SDKs, and external partners accessing internal environments or data. — Oversee vulnerability management lifecycle ensuring remediation paths are transparent, risk-based, and tracked to closure. — Oversee detection engineering, continuous threat monitoring, and serve as accountable executive for major incident escalations. — Own GCP and AWS multi-account architecture, Kubernetes, Terraform, and developer platform delivery to reduce lead times and change failure rates. — Embed technical security requirements across the development lifecycle, optimizing automated security controls within CI/CD pipelines. — Manage IT service provision including identity, hardware devices, collaboration tools, and joiner-mover-leaver lifecycle workflows through automated, self-service access controls. — Direct cross-functional roadmaps for user-facing security services and account safety including authentication, session management, and cryptography. — Establish governance, scoping, permissioning, security guardrails, and auditing for AI-assisted engineering agents and consumer-facing AI features. — Advocate for security in FemTech through external communications and industry engagement. Требования: — Proven leadership managing combined or parallel Security and Production Infrastructure functions at consumer scale (tens of millions of active users). — Experience partnering with Product, Design, and Mobile/Backend Engineering teams to ship user-facing features. — Successful execution and maintenance of ISO 27001, SOC 2, HIPAA, or equivalent certification frameworks through external audits. — Deep technical experience implementing GDPR, automated data deletion, retention policies, DPIAs, and cross-border transfer controls programmatically. — Practical experience securing AI models, autonomous code/development agents, and automated permission/audit systems. — Preferred: experience with consumer sign-in optimization, health/biometric data protection, in-house offensive security engineering, and mobile platform security. Условия: — Annual salary range £200,000 - £220,000 GBP. — Hybrid work model with 3 days per week in the office in London. — Paid holiday, sick leave, female health leave, enhanced parental leave. — Performance incentive scheme. — Accelerated professional growth and learning support. — 5-week fully paid sabbatical at 5-year anniversary. — Health, pension, and wellbeing perks. — Diversity, equity, and inclusion commitment. Additional info: — Flo holds ISO 27001 and ISO 27701 certifications and emphasizes privacy-first features such as Anonymous Mode. — The role involves responsibility for security strategy, governance, platform and infrastructure engineering, user identity and AI security, and external trust advocacy. — The company is mission-led, product-driven, and values fast, focused work with shared decision-making and high standards.