Information Security and Systems Lead, (Associate) Director

About the Information Security and Systems Lead Role

The Information Security and Systems team is the engine driving our uniquely dynamic, high-achieving, multicultural, multi-continental team at the cutting edge of how evidence is used to improve global development programs. This team’s mandate is to build and maintain systems that enable IDinsight teams across 7+ countries to achieve social impact. We are looking for an Information Security and Enterprise Systems Leader to own that mandate end-to-end. You will lead a small, capable team of security and systems specialists, fractional resources, and external implementation partners. You will report to and advise the executive team. This role could be a fit if you have high-quality experience running both security and enterprise systems initiatives at a global organisation and you're comfortable being the most senior technical voice in the room without being the only person who understands the decision.

Enterprise Systems Leadership

Strategy and roadmap - Define and own the multi-year enterprise systems strategy for a remote-first, globally distributed organisation, and the priorities that follow from it.

Systems implementation - Lead identification, selection, and implementation of new enterprise systems such as CRMs, ERPs, etc. Own architecture and integration decisions and the master data model that holds them together.

Implementation partner management - Select, contract, and manage external implementation and support partners, including scope, commercial terms, and delivery accountability.

Budget ownership - Lead annual budgeting and financial planning for organisational systems, and make the trade-offs that a non-profit budget requires.

Change management - Champion adoption across regions and functions, so that systems investments produce behaviour change.

Operational effectiveness - Identify bottlenecks and inefficiencies across the estate, streamline usage to reduce shadow IT, and ensure systems and support functions operate reliably across time zones.

Leadership partnership - Work with functional and regional leadership on requirements, prioritisation, and the systems implications of organisational strategy.

Information Security Program Management

Security strategy - Define and own the information security strategy in alignment with organisational strategy and recognised frameworks, and monitor delivery against the roadmap.

Control framework - Lead implementation of security and privacy controls as regulation, client obligations, and risk require.

Governance - Coordinate the Information Security Steering Committee and contribute to Enterprise Risk Management.

Incident response - Own incident response planning, lead coordination during incidents, and drive the changes that follow.

External assurance - Commission and support penetration tests, vulnerability assessments, audits, and own remediation.

Risk management - Lead periodic risk assessment exercises and the ongoing identification, mitigation, and monitoring of information security risk.

Due diligence - Serve as senior point of contact for funder, client, and government partner security and data protection due diligence.

Investigations - Support Legal, Compliance, and Operations where digital evidence is relevant to policy violations.

Data Protection and AI Governance

Multi-jurisdiction compliance - Own compliance with GDPR and the national data protection regimes in the countries where we operate, including data mapping, retention, subject rights, and impact assessments.

AI governance - Define how IDinsight governs AI use on project and organisational data: tool assessment, acceptable use, and the controls that make responsible use the default.

Policy - Own the information security and data protection policy set, and keep it usable enough that colleagues consult it rather than route around it.

Team and Function Leadership

People management - Manage, develop, and grow full-time techn...