Group Head of IT

Group Head of IT

Department: IT

Employment Type: Full Time

Location: London

Reporting To: Angus Beaumont

Harmony is on a mission to be the best life safety partner to work with and for. Rated an ‘Outstanding Employer’ by Best Companies in 2025, we are only getting bigger and stronger — and we’re looking for A-players to help us get there.

We are passionate about making a difference and obsessed with quality. Our goal is to build a world where every resident can sleep safely at night, knowing their home is 100% safe.

This is a security‑first leadership role. You will own cyber security and data protection across the Harmony group (Harmony Fire, Solidcor, Auro Technology) end‑to‑end — strategy, delivery and BAU — acting as the most senior security voice in the business below the Group IT Director. Cyber Essentials Plus, IASME Cyber Assurance and ISO 27001 sit with you. UK GDPR compliance sits with you as the group’s Data Protection Lead (a non‑statutory role distinct from a formal DPO appointment).

The group’s security posture, risk register, incident response and audit defensibility all sit with you. If something has a security or data protection dimension, it lands on your desk first.

Security cannot exist in isolation, so you will also run the day‑to‑day IT function — line‑managing the IT Technician, overseeing the helpdesk, vendor stack and infrastructure resilience for around 250 users across three trading entities. Operations exist to deliver a secure platform, not the other way around. IT Project Managers will deliver new systems into the group; you will accept those handovers and ope rationalise them into BAU only once they meet your security bar.

Reporting to the Group IT Director, you will be the security leader the group trusts to keep its people productive, its data protected and its certifications intact through ~30% year‑on‑year growth.

This is more than an IT role. It is about bringing the right energy, accountability and resilience to our mission of saving lives through fire and height safety.

• Own the group’s cyber security strategy, posture and risk register — the most senior security accountability in the business below the Group IT Director.
• Lead all formal security certifications end‑to‑end:
  Cyber Essentials Plus annual recertification, IASME Cyber Assurance alignment and ISO 27001 ISMS — scoping, risk treatment, Statement of Applicability, internal audits, management review and external audit defence.
• Apply additional frameworks where they strengthen the group’s posture — NIST CSF, CIS Controls, NCSC Cyber Assessment Framework — and embed them into operational practice.
• Act as the group’s Data Protection Lead (not a statutory DPO under UK GDPR Article 37) — own UK GDPR and DPA 2018 compliance, ROPA, DPIAs, retention schedules, DSARs, breach notification, processor agreements and supplier due diligence.
• Run security operations day‑to‑day — endpoint protection (Bitdefender Gravity Zone), conditional access, MFA, identity governance, vulnerability management, and security awareness and phishing simulation programmes via Know Be
  4.
• Lead incident response — triage, containment, recovery, post‑incident review and reporting, with playbooks kept current and tested.
• Oversee security across Auro Technology’s software stack — IoT device firmware, cloud platforms, mobile and web applications — partnering with the Auro engineering team on secure SDLC, code review, dependency management, secrets handling and product security posture.
• Act as the security gatekeeper for IT project handovers — accept newly delivered systems from IT Project Managers into BAU only once documentation, monitoring, support runbooks and security controls meet the group’s bar.
• Run vendor and licensing relationships across the IT and security stack — renewals, commercial negotiation and security due diligence on every new supplier before they are onboarded.
• Run the day‑to‑day IT function in service of the security mission — line‑manage the IT Technician, oversee the Atera helpdesk, own SLAs and personally take the hardest tickets when they have a security dimension.
• Maintain infrastructure resilience…