Data Security Lead

Data Security Lead Overview

Arup is looking for a Data Security Lead to help establish and run a new data security service within its Cyber Resilience function. This position sits in the Digital Technology group and works alongside teams focused on Security Operations, Governance, Risk and Compliance, Identity and Access Management, Security Engineering, and Privileged Access Management. The wider remit is to protect Arup’s platforms, information, and data while supporting the firm’s purpose-driven work.

The role is centred on creating a new service from the ground up. You will define the service vision, decide how it should operate, set the roadmap, and establish the measures that will show whether it is succeeding. You will also take responsibility for turning the Data Security Plan into a practical delivery programme that can be sustained over time. In addition to strategic leadership, the role requires close collaboration with technical and business stakeholders to make sure data protection is embedded into everyday operations and project delivery.

What you will do

• Take ownership of Arup’s data security service and lead its launch, including the overall vision, operating approach, roadmap, and success criteria.
• Convert the Data Security Plan into a clear, prioritised, multi-year delivery plan that covers governance, classification, data loss prevention, encryption, monitoring, and resilience.
• Provide a single accountable lead for data security outcomes across the organisation.
• Set up the governance structure and operating model needed to run the service effectively.
• Build the team and work with colleagues across Cyber to make data protection part of how the firm works and delivers for clients.
• Work with senior leaders and technical specialists to turn strategy into action and to keep priorities aligned with business needs.
• Advise on difficult data security risks and help track delivery progress against the plan.
• Improve how data is protected across its full lifecycle, ensuring the service moves from design into stable operational delivery.
• Collaborate with Security Operations and Governance, Risk and Compliance as part of the wider Cyber Resilience team.

The role combines high-level leadership with practical delivery. On a typical day, you may be shaping priorities with stakeholders, reviewing complex risks, guiding technical teams, and making sure the service continues to mature and deliver measurable protection for Arup’s data.

What Arup is looking for

• Strong expertise in data security, especially in areas such as classification, data loss prevention, encryption, and lifecycle protection.
• Good knowledge of relevant security standards and frameworks, including ISO/IEC 27001, NIST CSF, and CIS Controls.
• Proven experience leading or owning a security service or capability at enterprise or global scale.
• The ability to operate strategically and operationally, turning plans into long-term delivery.
• Excellent stakeholder management skills, including the ability to influence senior leaders and technical teams.
• Experience creating governance, roadmaps, and operating models for a security function.
• Confidence working in a complex, collaborative environment where priorities must be shaped and delivered across multiple teams.

Reward and benefits

Arup says it offers a competitive and fair pay approach together with a broader reward package that recognises contribution and supports shared success. As a member-owned organisation, the firm shares profits with employees through a global profit share arrangement, with payments depending on the company’s financial performance.

• Competitive, fair, and equitable salary.
• Global profit share scheme.
• Private medical insurance.
• Life assurance.
• Accident insurance.
• Income protection cover.
• Flexible benefits to support wellbeing and personal or family needs.
• Learning opportunities and development support.
• Benefits aimed at health and wellbeing.

Arup also emphasises that it is owned in trust on behalf of its members, which gives the organisation the freedom to choose work aligned with its purpose and values.

Culture, inclusion, and support

The company describes itself as an equal opportunity employer with an active commitment to building and supporting a diverse and inclusive workforce. Applications are welcomed from people of all backgrounds, subject to legal limits where relevant. The organisation says it values different experiences, perspectives, and ideas, and that this diversity helps drive excellence.

Arup also highlights employee networks that support inclusion across race and cross-cultural working, gender equity, LGBTQ+ inclusion, and disability inclusion. The company says it aims to create a sense of belonging and to contribute to fairer spaces and systems in line with its values and the UN Sustainable Development Goals.

Accessibility is also called out as part of the recruitment process and workplace. Candidates who need assistance or reasonable adjustments during application, interview, or to carry out the essential duties of the role are encouraged to ask for support, and the company says it will do what it can to help.

Application process

Applicants are directed to apply through Arup Careers. The page also notes that candidates can visit the careers site to learn what to expect next in the recruitment process. Arup includes a reminder to be cautious online and states that it will never request payment or bank details as part of recruitment.

The role is advertised in Cardiff, with additional locations listed in Madrid, Leeds, Krakow, Birmingham, Bristol, and London.

Degree Requirement: Not Specified

Visa Sponsorship May be