Penetration Testing & Vulnerability Management

• Lead regular external pen tests of applications and infrastructure, tied to triage and remediation SLAs.
• Own the cyber risk programme:
  • Repeatable vulnerability scanning
  • Prioritisation based on business exposure
  • Close-loop remediation and closure (directly impacting results seen by auditors).
  • Collaborate with Compliance on presenting evidence (clean data for frameworks, solid evidence of fix).

Incident Response & Threat Intelligence

• End-to-end ownership of Fresha’s incident response process:
  • Detection-to-recovery sequence (detection, containment, eradication, recovery, lessons learned)
  • Design and run on-call operations, playbooks, and tabletop drills to ensure business resilience.
  • Lead post-mortems that share honest learning points.
• Build a threat awareness capability combining:
  • Information from external sources (reports, global intel)
  • Internal data (incidents, threat telemetry)
  • Feed this into engineering decision-making: helping prevent future attacks, guiding investment priorities.

Threat Modelling, Proactive Risk

• Implement Threat Modelling as a regular practice (not just an initiative).
  • Include automated tools using AI to scan architectural and code changes.
• Evaluate how new risks like large language models (LLMs) can be compromised (prompt injection, model misuse, SLA breaches).
  • Be the company’s forward-looking intelligence voice.
  • Actively invest to be save from future threats, not reactively.

Security Training & Awareness

• Design and deliver forthright security training relevant to Fresha’s threat landscape:
  • Phishing simulations
  • Secure coding for engineers
  • Cyber threat modelling workshops
  • Scene-specific training (PCI, HIPPA, PHI handling).
• Partner with Compliance to deliver regular updates—training is a loop, not a single check-box action.

Automation & Efficiency

• Eliminate manual intervention in security operations:
  • Focus on alert triage, incident closure strategies, risk prioritisation, threat intel collation.
  • Strategically use code, workflows, and AI without over-reliance.
  • Refine operations to reduce manual tasks, enhance coverage, and speed response.

Advisory & Security Advocacy

• Serve as the internal go-to on all security-enablement fronts:
  • Provide clear direction, not bureaucracy.
  • Work with technical teams to make informed, confident decisions on:
    • New products, integrations, acquisitions.
    • Architecture and vendor audits.

Desired Qualifications

• ** Händen of experience leading security within a heavily regulated business** (e.g., payments, industrials, healthcare, financial services).
• Department experience in incident response (not just prepped exercises)—proof-of-study documentation and detailed learning from each case.
  • Hands-on experience translating actionable, real-world incident learnings.
• Advanced understanding of modern attack surfaces, cloud environments, supply chains, application layering, and user identity.
• Experienced threat modelling implementation—not just used generic resources, but drives custom fit.
• Designing AI-integrated processes—not only find inefficiencies but solve the process flow.
  • Know how LLMs can help, but also where they force new challenges.
• Existing multi-disciplinary leadership. Capabilities to engage as an equal with:
  • Core technical engineering teams (dedication, technical depth).
  • Business leadership (clarity in framing, value and strategies).
• Bonus: Payments/PCI DSS certification, SOC assessments, experience in applied offense.

How You’ll Work

• Lead a SecOps team from day one.
• Work directly with the EVP across all initiatives and with Compliance/IT/Engineering/product teams.
• Respond with speed and precision—total ownership, not just administration.
• Engage regularly with customers, financial service auditors, and compliance stakeholders.
• Continuously develop technical expertise, rather than act as purely a "dumping ground" for responsibilities.

Interview Process

1. Screening
   • Video call with Talent Team (~60m).
2. Round 1
   • VP of Security_, IT & Compliance (~60m).
3. Round 2
   • Virtual interview with CTO (~60m) and Head of Talent (~30m).

The process will be completed within 4 weeks, and feedback provided meticulously to all candidates.

Fresha’s Core Values

• Empowerment: We reshape how professionals harness self-care—your input is valued and utilised.

• Collaboration: Our culture thrives through teamwork and knowledge sharing, both in-person and across borders.

• Inclusivity: We promote a safe, equitable environment:**

  • World-class opportunities for all potential candidates, regardless of background.
  • Every role conducted without biases on race, sexual identity, disability, or any related factor.
  • If accessibility requirements make the process comfortable, let us know—our team is prepared to support you.

We may use AI tools to assist in screening or skill assessment—but always maintain human oversight. Final decisions rest with us.

We’re on the hunt for a security leader—join us in defining the future of self-care in an evolving industry.