SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: GBP 65,000 - 75,000 / annual
AccuRx is a healthtech platform solving healthcare productivity for the NHS. The company has built an all-in-one digital toolkit used by 98% of GP practices, powering features including Total Triage for patient demand management, Self-Book for appointment scheduling, Patient Questionnaires for long-term condition management, Accumail for cross-care staff communication, and Accurx Scribe, an AI-powered note-taker that drafts medical notes in real-time. The platform supports approximately 300,000 NHS staff weekly and enables care for over 50 million NHS patients annually.
You will join the Information Security team as a hands-on, delivery-focused Information Security & Risk Officer, reporting to the Senior Information Security Officer. This is not a security engineering role; instead, you will focus on risk management, security advisory, customer and tender responses, audit readiness, and data strategy.
Key responsibilities include:
- Owning risk management: running risk sessions across the business, maintaining the risk register, writing risk reports, and tracking treatment actions to completion
- Advising the business: serving as the security voice with Engineering, DevOps, IT, and Product teams, and acting as a first point of contact for security questions
- Handling customer, tender, and supplier interactions: answering security questionnaires accurately, responding to tenders, and assessing suppliers
- Maintaining audit readiness: gathering evidence throughout the year for Cyber Essentials Plus, DSPT, and ISO 27001 compliance, and identifying control gaps with practical solutions
- Delivering data strategy: driving data classification and access control programmes with data owners
You will understand the technical environment well enough to spot risks and gaps, then recommend best practices for technical teams to implement. A background in compliance management alone will not be sufficient; you need hands-on infosec and risk experience.
The role is office-first, requiring a minimum of 3 days per week in the Shoreditch office. You'll have access to regular hackathons, dedicated time to visit GP practices and healthcare settings, and 28 days of holiday plus up to 4 weeks to work from anywhere annually.
REQUIREMENTS:
- Hands-on infosec and risk experience, ideally in health-tech, regulated SaaS, or software development
- Proven track record running risk sessions, managing risk registers, and reporting on risk to senior stakeholders
- Technical depth in: authentication vs. authorization, least privilege, IAM, network segmentation, firewalls, patch and vulnerability management, endpoint protection, and cloud infrastructure
- Understanding of frameworks: ISO 27001, DSPT, NIST, and Cyber Essentials Plus, with sense of proportionate security in fast-moving product companies
- Ability to work fast and independently, managing own workload, flagging blockers early, and context-switching between tenders, questionnaires, and engineering conversations
- Genuine care about healthcare and understanding that protected data belongs to patients and clinicians
- Nice to have: enterprise risk management experience and prior CE+ audit cycle experience
