Head of Information and Cyber Security

About

The Role  Onodrim is building Europe's largest defence and industrial platform. We acquire specialist manufacturers in critical defence and dual-use supply chains, then invest behind their growth with capital, technology and operating know-how.
Onodrim is building Europe's largest defence and industrial platform. We acquire specialist manufacturers in critical defence and dual-use supply chains, then invest behind their growth with capital, technology and operating know-how. The Head of Information Security owns security across the whole platform:
Onodrim itself and every company we acquire. A defence platform with investor backing is a target for state actors, criminal groups and everyone in between. Our acquired companies arrive with their own networks, their own IT people and their own history - and they build things that must not leak. You'll set the standard, make it real at each site, and be the person who picks up the phone when something goes wrong.
This is a hands‑on role. Onodrim itself is a small, young company. You'll take over its security from the CTO on day one and run it yourself, then extend it to sub‑cos that look nothing like it: on‑premise ERP, shop‑floor networks, machine controllers, and a plant IT administrator who has done everything alone for fifteen years.
Alongside security you'll own the basics of corporate IT for Onodrim - identity and access, devices, SaaS administration, onboarding and offboarding - and set the model for how sub‑co IT is run and, where it makes sense, consolidated.
What You'll Do   Own the security programme. Set Onodrim's security strategy, standards and risk appetite
Run Onodrim's own estate. Operate and harden identity and access, endpoint management, the productivity suite and the rest of the SaaS stack
Secure the sub‑cos. Within the first weeks after each acquisition, assess the company's security posture, fix what is urgent, and bring it onto the platform standard over time - without disrupting production
Support the deal team. Run security and IT due diligence on acquisition targets: what they run, what has happened to them, what it will cost to fix, and what could kill the deal
Protect the shop floor. Bring OT and industrial control systems into scope: network segmentation, machine access, vendor remote access, and the gap between the IT and OT teams
Lead incident response. Own detection, response and recovery across the platform; run tabletop exercises; be the escalation point when something happens at 02:00 at a sub‑co
Get and keep the certifications that unlock business. Drive ISO 27001, NIS2 readiness and the national defence‑industry and classified‑information requirements (e.g. BSI, Facility Security Clearance equivalents) that our customers and partners demand, and support export‑control compliance (ITAR/EAR, EU dual‑use) on the technical side
Manage third‑party and supply‑chain risk. Assess vendors, cloud providers and partners; put the right contractual and technical controls in place
Run corporate IT for the Top‑Co. Own device procurement and lifecycle, joiner/mover/leaver, SaaS licensing and administration, and first‑line support - either directly or through a managed provider you select and manage
Set the sub‑co IT model. Decide what gets consolidated (identity, email, endpoint, backup), what stays local, and how plant IT teams plug into the platform
Build the function. Hire and manage security and IT staff as the platform grows; select and manage MSSPs, MDR providers and auditors in the meantime
Make security usable. Write policies people can follow, train staff, and design controls that a 20‑person company and a 500‑person manufacturer can both live with
What you'll bring   5+ years in information security, with at least…