Information Security Assurance Manager

Information Security Assurance Manager

London | Full-time | In office 4 days/week

Our vision is a world where all businesses are powered by embedded payments. Modulr enables businesses, from SMEs to Enterprise, to grow their revenue, drive efficiencies and deliver fantastic customer experiences, by embedding payments into their products and operating systems. We do this by providing products and services which allow our clients to efficiently collect, reconcile and disburse funds instantly via a range of payment schemes, accounts, and card products, fully controllable via API.

Find out more about us on our website and careers site.

• Lead and complete information security assurance activities in support of internal audits, external audits, certifications, and regulatory reviews.
• Act as the primary information security point of contact for internal audit, external auditors, and regulators.
• Plan information security audit scope, timelines, and evidence requirements in collaboration with governance and delivery teams.
• Coordinate and run information security control walkthroughs, interviews, and technical deep dives with engineering, platform, and operations teams.
• Review, validate, and challenge information security control evidence to ensure it is accurate, complete, and auditable.
• Independently assess the design and operating effectiveness of information security controls against governance owned policies, standards, and regulatory expectations.
• Produce clear and information security assurance findings and audit reports for technical, executive, and regulatory audiences.
• Identify and communicate information security control observations and assurance outcomes to the security governance to inform governance led risk assessment and decision making.
• Track information security audit findings through to closure, validating remediation implementation without owning delivery.
• Identify recurring or systemic information security control observations and elevate them through agreed governance forums.
• Act as a pragmatic but independent assurance partner, ensuring information security assurance activity enables compliant, well controlled delivery.

• Significant experience in information security assurance, audit, or second line security roles within a regulated environment.
• Proven experience leading internal and external information security audits end to end, including direct interaction with auditors and regulators.
• Strong understanding of information security control design and operating effectiveness, particularly across cloud, SaaS, identity, and modern application environments.
• Experience assessing security controls against regulatory requirements and recognised frameworks such as PCI-DSS, ISO 27001, SOC 2, or equivalent.
• Ability to critically assess audit evidence, identify gaps or weaknesses, and challenge findings constructively using facts and documentation.
• Clear understanding of the separation between assurance, governance, and delivery, and the discipline to maintain independence.
• Strong written and verbal communication skills, with the ability to explain assurance findings clearly to both technical teams and senior stakeholders.
• Confidence operating autonomously, managing multiple audits or assurance activities in parallel without loss of quality.

• Experience working in fintech, financial services, or similarly regulated environments.
• Direct experience supporting regulatory reviews, supervisory visits, or thematic inspections.
• Prior exposure to internal audit functions or working as a second line assurance partner to internal audit.
• Familiarity with multiple security and risk frameworks and how auditors interpret them in practice.
• Experience pushing back on auditors with evidence while maintaining constructive relationships.
• Professional certifications in information security, assurance, or audit (e.g. CISM, CISSP, CISA), without being framework driven.
• Experience operating in fast moving technology environments where assurance must be risk based and pragmatic, not checkbox led.

• Share Options – We offer a Company Share Option Plan (CSOP), giving you the…