About o2h technology:

o2h Technology is the technology and digital services arm of o2h Group, established in 2017 with a vision to bring science, biology, and technology together to foster innovation and collaboration.

Headquartered in Cambridge, UK, o2h Group operates within one of the world’s leading science and technology ecosystems, giving us close exposure to emerging innovations in technology and AI.

We specialise in customised software development and digital solutions for startups, scale-ups, and mid-sized to enterprise businesses. Our expertise spans web and mobile development, cloud technologies, AI/ML, and modern frameworks including React, Node.js, Python, Flutter, AWS, TensorFlow, and PyTorch.

At o2h Technology, we build digital products that help transform life sciences, health tech, and green tech—from MVPs for startups to complete, end-to-end technology solutions for fast-growing businesses across the UK and globally.

Key Responsibilities:

• Contribute to setting up and strengthening the cybersecurity function at o2h Technology, working closely with senior team members to establish security processes, protocols, controls and long-term security initiatives.
• Monitor security alerts, logs, endpoints, applications, networks and cloud environments; investigate and respond to security incidents and threats.
• Conduct vulnerability assessments, security audits and VAPT/penetration testing, and ensure timely remediation of identified risks.
• Work on external client cybersecurity projects, including security assessments, VAPT, vulnerability management, security reviews and implementation of cybersecurity controls.
• Assess and improve application and API security, including OWASP Top 10, authentication, authorization, data protection and secure coding practices.
• Secure and review cloud and infrastructure environments including IAM, network security, encryption, firewalls, endpoints and system hardening.
• Work with the QA team on internal product security testing, identifying application/API vulnerabilities and supporting remediation before releases.
• Work closely with Development and DevOps teams to implement Secure SDLC and DevSecOps practices, including SAST, DAST, dependency and secrets scanning.
• Develop and maintain incident response processes, conduct root-cause analysis and implement preventive measures.
• Manage cybersecurity risks, policies, controls and compliance requirements, supporting frameworks such as ISO 27001, SOC 2 and GDPR, where applicable.
• Conduct security assessments of third-party vendors, applications and technology platforms.
• Conduct cybersecurity awareness initiatives and guide employees on security best practices.
• Prepare security reports, track vulnerabilities/incidents/KPIs and provide management with recommendations to strengthen the overall security posture.
• Continuously evaluate emerging cybersecurity threats, tools, AI and automation opportunities to improve security operations.

Key Requirements: 

• Minimum 4 years of hands-on experience in Cybersecurity, Information Security, Cyber Security Engineering, Application Security or a related field.
• Strong practical knowledge of application, API, cloud, infrastructure and network security.
• Hands-on experience in VAPT, vulnerability management, security assessments and incident response.
• Strong understanding of OWASP Top 10, secure coding and API security.
• Experience with AWS/Azure/GCP, IAM, networking, firewalls, encryption, endpoint security and system hardening. 
• Understanding of SIEM, EDR/XDR, IDS/IPS and security logging.
• Experience with Secure SDLC / DevSecOps and security tools such as SAST, DAST, SCA/dependency and secrets scanning.
• Familiarity with tools such as Burp Suite, OWASP ZAP, Nessus/OpenVAS or equivalent.
• Working knowledge of ISO 27001, SOC 2, GDPR and information-security risk management.
• Strong analytical, problem-solving, documentation and communication skills.
• Ability to work independently, take end-to-end ownership and collaborate effectively with Development, DevOps, IT and management teams.
• Proactive mindset with the ability to identify security gaps and implement practical solutions.
• Cybersecurity certifications such as CEH, OSCP, Security+ or ISO 27001 are preferred.
• CISSP or CISM certification would be an added advantage.

Education: Bachelor’s/Master’s degree in IT/Computer Science/Cyber Security or related field

Experience: Minimum 4 years