Data Security Lead

Data Security Lead Overview

Arup is looking for a Data Security Service Lead to establish and run a new data security capability within its Cyber Resilience function. This position sits in the Digital Technology Group and works alongside teams focused on security operations, governance, risk and compliance, identity and access management, security engineering, and privileged access management. The purpose of the role is to strengthen how Arup protects its platforms, information, and data by turning data security strategy into a practical, sustained service.

The successful person will take ownership of the new data security service end to end. That includes setting the direction for the service, defining how it will operate, building the roadmap, and deciding how progress and success will be measured. The role is intended to provide a single point of accountability for data security outcomes across the organisation, with responsibility for turning the data security plan into ongoing delivery that can be embedded into business-as-usual operations.

What you will do

• Set up Arup’s new data security service and define its long-term vision, operating model, roadmap, and success measures.
• Own delivery of the data security service and ensure the plan is translated into sustained operational activity.
• Build the team needed to support the service and establish the governance structure that will keep it effective.
• Work with cyber security peers and other stakeholders to embed data protection into the way the organisation works and delivers projects.
• Turn the data security strategy into a clear, prioritised, multi-year delivery plan.
• Cover key areas such as governance, data classification, data loss prevention, encryption, monitoring, and resilience in that plan.
• Work with senior leaders and technical specialists to turn strategy into practical action.
• Advise on difficult data security risks and help shape priorities across the organisation.
• Monitor progress against the roadmap and continuously improve how data is protected across its lifecycle.
• Balance strategic leadership with hands-on operational oversight so the service delivers real outcomes.

What Arup is looking for

• Deep expertise in data security, especially in data classification, DLP, encryption, and protection of data throughout its lifecycle.
• Strong knowledge of recognised security standards and frameworks, including ISO/IEC 27001, NIST CSF, and CIS Controls.
• Proven experience leading or owning a security service or capability at enterprise or global scale.
• Ability to operate effectively at both strategic and operational levels and to turn plans into lasting delivery.
• Strong stakeholder management skills, including the ability to influence senior executives and technical teams.
• Experience working collaboratively across security functions and with a range of internal partners.
• Ability to work from one of the advertised locations, which include Cardiff, Madrid, Leeds, Krakow, Birmingham, Bristol, and London.

Team and company context

This role sits within Arup’s Cyber Resilience team, which forms part of the Digital Technology Group. The team brings together specialists in data security, identity and access management, security engineering, IAM administration, and privileged access management. It works closely with security operations and governance, risk and compliance colleagues to protect the organisation’s systems and information.

Arup describes itself as a purpose-led organisation with a collaborative culture and a long history of working on socially useful projects. The company emphasises shared values, diversity of experience, and the opportunity to do work that has meaning for the business, its members, and the communities it serves. The Digital Technology team is also noted as a previous winner of IT Team of the Year at the Chartered Institute of IT’s UK IT Industry Awards.

Rewards and benefits

• Competitive pay that is fair and equitable.
• A broader reward package that recognises contribution and supports shared success.
• Access to health and wellbeing support.
• Learning and development opportunities across a wide range of areas.
• The chance to make a meaningful impact through your work.
• Membership in a trust-owned organisation where employees share in the firm’s success.
• Participation in a global profit share scheme, with payments linked to the firm’s financial performance.
• Private medical insurance.
• Life assurance.
• Accident insurance.
• Income protection cover.
• Flexible benefits that can be adapted to suit personal, family, and wellbeing needs.

Inclusion, accessibility, and application information

Arup says it is an equal opportunity employer and welcomes applicants from all backgrounds. It states that it actively supports a diverse and inclusive workforce and encourages applications regardless of age, gender identity or expression, marital status, disability, neurotype or mental health, race or ethnicity, faith or belief, sexual orientation, socioeconomic background, or pregnancy and family leave status, where legally permitted.

The company also highlights internal employee networks that support inclusion across race and cross-cultural working, gender equity, LGBTQ+ inclusion, and disability inclusion. It says it is committed to making recruitment and the workplace accessible, and invites candidates to request assistance or reasonable adjustments during the application or interview process, or to help them carry out the essential functions of the role.

Applicants are directed to use Arup’s careers application process to understand the next steps. The page also includes a reminder that Arup will never request payment or bank details as part of recruitment, as part of its online safety guidance.

Degree Requirement: Not Specified

Visa Sponsorship May be