About Orbital

Orbital is the AI platform for real estate legal work, connecting legal and physical records to make transactions faster, clearer, and less manual.
Built by former practising real estate lawyers with 250+ years of combined legal expertise.
Trusted by 5,000+ real estate professionals, including UK Magic Circle and US Am Law 100 firms, and companies like M&S, BCLP, Orrick, Goodwin, Womble Bond Dickinson, and Clifford Chance.
Raised $60M Series B (led by Brighton Park Capital), $75M total funding, to accelerate global expansion.
Team is bold, ambitious, and trusted to take ownership and make an impact from day one.

The Role

Senior, London-based InfoSec Lead to own information security due diligence, compliance, and vendor risk end-to-end.
Function currently covered on a contractor basis; goal is to bring it in-house, automate manual tasks (e.g., customer DDQs), enhance compliance posture, and make InfoSec a proactive enabler of growth.
Full-time role working alongside IT Manager; both report independently to Head of Operations with separate but interconnected remits.
Collaborate closely with Engineering, Product, Legal, and external InfoSec support to embed security and compliance into business operations.

InfoSec & Compliance Delivery

Own InfoSec strategy and roadmap: set direction for scaling security and compliance, identify control gaps, prioritize remediation, track to completion.
Own risk program: run risk identification, assessment, treatment; maintain risk register; decide acceptable risk levels.
Own third-party risk assurance in both directions: vendor security reviews for onboarding/renewals; customer and vendor due diligence (DDQs) when assessed.
Pull in cross-functional support and join client calls to resolve DDQs.
Drive automation of DDQ processes to reduce manual overhead.
Own existing and future compliance certifications: maintain ISO 27001 and SOC 2 Type 2; pursue future relevant certifications; manage compliance program end-to-end (ISMS management reviews, quarterly access control reviews, audit evidence gathering, scheduling, remediation tracking).
Keep policy and public-facing security documentation (e.g., trust centre) current so certification is a continuous capability.
Partner cross-functionally with Engineering, Product, and Legal to embed security and compliance requirements into building and selling; stay close to product changes to ensure customer-facing security information is accurate.

Significant senior in-house or scale-up InfoSec leadership experience: owned due diligence, vendor review, and compliance end-to-end in a fast-moving business.
Strong understanding of cloud and cloud security; ideally previous technical background in IT Security, Software Engineering, or DevOps.
Track record of scaling due-diligence processes: able to template, automate, or self-serve, and execute on it.
Comfortable working closely with engineering: happy in technical conversations, understanding product changes, and weighing in on security-sensitive changes.
Pragmatic and delivery-focused: distinguish genuine risk from distraction; keep due diligence and audit work moving at commercial pace.
AI-literacy with working familiarity with AI governance (ISO 42001, EU AI Act, etc.).
Comfortable operating independently: individual-contributor role with real ownership of roadmap, not a narrow audit-only remit.
Working knowledge of privacy law (GDPR, CCPA, US state privacy laws) to partner with legal function.

You want to run day-to-day IT operations or manage IT staff (that sits with the IT Manager).
You prefer tasks defined and handed to you; this role requires an independent decision maker who identifies needs, sets plans, and drives closure.
You feel more comfortable with a narrowly-defined, audit-only remit; this role sits close to Engineering, Product, and Legal and actively reduces manual DDQ overhead.

Shape how security and compliance scale with the business; processes and playbooks are still being built.
Genuine cross-functional influence: work closely with Engineering, Product, and Legal.
Genuine momentum: $60M Series B, doubling headcount, expanding across two continents.
Leadership treats security as a business enabler, not just a risk function.

Security is everyone’s responsibility: all team members follow security policies, complete regular awareness training, and handle sensitive data per ISO 27001 standards; reporting risks or incidents quickly is expected.
Committed to building a diverse and inclusive team; especially welcome applications from people traditionally underrepresented in tech; even if you don’t meet every requirement, we’d love to hear from you.
Hiring range is a reasonable estimate of base pay for this position at time of posting; pay based on job-related knowledge, skills, experience, and business requirements.
All team members go through background screening before starting to maintain security for employees and client information.

Imported from Orbital’s job posting on jobs.ashbyhq.com. Apply sends you to the original listing.