Cyber Security Lead – UK Healthcare

About the role

We are looking for an experienced Cyber Security Lead to own the security posture of MSI UK’s healthcare environment, ensuring compliance with NHS and UK regulations while protecting digital assets.

Key responsibilities

• Lead Cyber Security Strategy & Oversight across MSI UK.
• Governance, Risk & Compliance: ensure adherence to DSPT, CAF, CE+, ISO 27001, GDPR/DPA.
• Security by Design: support secure architecture, systems design and resilience planning.
• Incident Response: act as primary escalation point, lead investigations and remediation.
• Policy & Process: develop and enforce security policies and technical controls.
• Threat & Vulnerability Management: monitor, identify and oversee remediation of risks.
• Identity & Access Management: ensure strong authentication and least‑privilege access.
• AI Governance: support safe, compliant adoption of AI technologies.
• Third‑Party Risk: assess and manage vendor and SaaS provider security.
• Security Awareness: deliver training and promote a strong security culture.
• Reporting: provide clear updates on risks, incidents and improvements to leadership.

Required profile

• Minimum 5 years of cyber security experience with leadership or ownership of security functions.
• Strong knowledge of network, application, cloud (AWS/Azure) and endpoint security.
• Hands‑on experience with SIEM (e.g., Arctic Wolf), Fortinet firewalls, Nessus and vulnerability remediation.
• Experience working with SOC teams and supplier security assessments.
• Familiarity with CAF, CE+, NIST, CIS Controls and ISO 27001.
• Understanding of healthcare data protection, preferably NHS/UK standards.
• Strong incident response, analytical and problem‑solving abilities.
• Knowledge of AI/ML risks and AI governance.
• Experience with phishing campaigns, penetration testing and remediation.
• Excellent communication skills with technical and senior stakeholders.

Required skills

• SIEM (Arctic Wolf)
• Fortinet firewalls
• Nessus vulnerability scanner
• AWS cloud security
• Azure cloud security
• Network security
• Application security
• Endpoint security
• ISO 27001
• NIST framework
• CIS Controls
• CAF (Cyber Assessment Framework)
• CE+ (Cyber Essentials Plus)
• AI governance
• Penetration testing
• Phishing campaign management
• Identity & Access Management (IAM)