Product and cloud security

• Own security across the product estate: Fynapse on AWS and Azure, the established accounting products on AWS and at customer sites, and the payments platform.
• Set the standard for secure design, secure build and release gating, and work with engineering leadership to embed it in the delivery pipeline rather than bolt it on at the end.
• Run vulnerability management as a single process across all products, from detection through triage, remediation and customer communication, and close the coverage gaps where some products are today outside the standard tooling.

Governance, risk and compliance and vendor management

• Own ISO 27001, SOC 1, SOC 2 and PCI DSS compliance, the audit calendar, the compliance automation platform and the relationship with our auditors.
• Work with legal and the Data Protection Officer function on data protection, data residency, sub-processor oversight and customer contractual security commitments.

Business continuity and disaster recovery

• Own the business continuity and disaster recovery programme, including the annual test schedule, tabletop exercises and the remediation that follows them.
• Make sure recovery is tested to improve resilience, not only to satisfy an audit.

Team leadership

• Lead, develop and retain a team of four security professionals spanning cloud and product security operations, security controls and compliance, security programme management, and engineering operations tooling.

Working with technology leadership

• Act as a sparring partner to the CPTO, the Head of Engineering and the architects: challenge design decisions, argue for the right trade-offs between delivery and risk, and be prepared to be challenged back.
• Contribute to the technology strategy, including the multi-year migration of customers from our established products to Fynapse, so that security is designed into that journey.

What We Are Looking For

Essential

• A career in security. You have worked hands-on in technical security roles before leading them and are fluent in the concepts: threat modelling, vulnerability management, cloud security architecture, identity and access, secure software development, detection and response.
• Experience leading a security team, including line management, development and retention of specialists. You do not need to have managed managers.
• Experience running security in a software or SaaS company serving regulated enterprise customers, and of facing those customers on security matters.
• Working knowledge of ISO 27001 and SOC 2, and experience of being accountable for audits and certifications. PCI DSS experience is an advantage.
• Practical understanding of cloud security on AWS and Azure, Kubernetes-based platforms, infrastructure as code and modern CI/CD.
• Experience owning or running third-party and vendor risk management.
• The judgement to distinguish theoretical from practical risk and to prioritise accordingly.
• Clear, direct communication in writing and in person.

What Success Looks Like in the First Year

• Security is one function with one owner, a clear structure and a published roadmap.
• The vulnerability management and version support policies are fully embedded, and remediation times against them are measured and reported.
• Every product sits within the standard security tooling and monitoring estate.
• Critical knowledge and privileged access are held by more than one person.
• Customers, auditors and the board receive regular, consistent reporting on our security position, and account teams have a defined position to take to customers on patching and support.