Platform Security & Compliance Lead at AND Digital, London, 3 Months, £Contract Rate

Principal Security & Compliance Lead (3 Month Contract)

Location: London 1-2 days per week onsite

Who We Are:
AND Digital are a tech company focused on accelerating digital delivery and dedicated to closing the digital skills gap. We’ve been helping organisations build better digital products and stronger digital teams since 2014.

We believe our work should always leave a legacy for the client. We do this through close relationships with our offices (or ‘Clubs’) so that our partners are always prioritised by a regional team close to them.

This unique model has driven success for our clients and ourselves, evidenced by our remarkable organic growth since 2014. Today we number more than 1,300 people with Clubs all over the UK and Europe with plans for global expansion in the next couple of years.

Join us - and help us fulfil our mission to close the world’s digital skills gap.

The Role

We are seeking an experienced Platform Security & Compliance Lead to address an existing operational gap and strengthen security, governance and cost management across our AWS cloud platform.

This role will combine hands-on cloud engineering expertise with security and compliance leadership, focusing on improving access controls, establishing secure application development patterns, embedding governance best practices and optimising AWS cloud spend.

The ideal candidate will bring a strong understanding of AWS infrastructure, cloud security and penetration testing, with the ability to identify risks, implement pragmatic solutions and drive continuous improvement across the platform.

Key Responsibilities

Platform Security & Access Control

• Review and strengthen AWS access controls, IAM policies, roles and permissions, applying least-privilege principles.
• Identify and remediate security vulnerabilities, misconfigurations and gaps in existing cloud infrastructure.
• Improve identity and access management practices, including privileged access and secrets management.
• Establish and maintain security standards and guardrails across the platform.

Application Security & Secure Engineering

• Define and promote secure application development patterns and cloud-native security best practices.
• Embed security controls into CI/CD pipelines and infrastructure-as-code workflows.
• Work with engineering teams to identify and address application and infrastructure security risks.
• Apply knowledge of penetration testing, vulnerability assessment and threat modelling to improve the platform's security posture.

Governance, Risk & Compliance

• Strengthen platform governance, ensuring security controls and engineering practices align with relevant compliance requirements.
• Establish clear standards, policies and processes for cloud security and operational risk management.
• Support security reviews, audits, remediation tracking and evidence gathering.
• Improve documentation, ownership and accountability for security-related operational processes.

AWS FinOps & Operational Efficiency

• Review AWS usage and expenditure to identify opportunities for cost optimisation.
• Implement cost visibility, monitoring, tagging and resource governance practices.
• Balance cost efficiency with security, reliability and performance requirements.
• Promote accountability for cloud spend and sustainable platform operations.

Technical Leadership & Continuous Improvement

• Take ownership of identified operational gaps and drive them through to resolution.
• Work collaboratively with platform, cloud infrastructure, application engineering and security teams.
• Provide technical guidance on cloud security, secure engineering practices and governance.
• Develop repeatable processes and automation to reduce operational overhead and improve consistency.