Chief Information Security Officer

Make security the reason people trust Ockto Own security at the platform people use to share their most personal data Every day, people use Ockto to share their identity, income, assets and bank data: when they apply for a mortgage, rent a home or take out a lease. Banks and other large organisations choose Ockto partly because of the level of assurance we offer around that data. At Ockto, security is not a support function. It is part of the product and organisational culture. As our CISO, you make sure it stays that way as we grow. Part of that growth is adopting an AI driven operating model with strong guardrails. You own Ockto's security programme, from risk and controls to incidents, suppliers and audits. You set the standard, check that it is met, and make security measurable in a way that the whole organisation (and specifically our engineers and spec leads), clients, auditors and regulators all recognise. You do this with a real mandate and short lines to the people who decide. What you'll do You own the information security programme of a supervised financial company and make it work in daily practice, not just on paper. As CISO, you: • Own Ockto's ISMS and security policy framework, and keep our ISO 27001 certification (held since 2017) and our SOC 2 assurance current and credible. • Translate the risk appetite set by management into a security strategy, an annual plan and clear standards that teams can build to. • Keep Ockto ahead of what's coming. You track developments such as eIDAS2 and the EU Digital Identity Wallet, NIS2, the Cyber Resilience Act and the AI Act, assess what they mean for Ockto and our clients, and translate them into our security strategy and standards in time. • Verify and challenge. Our engineering teams operate the technical controls; you check that they work and that findings get fixed. You approve risk acceptance for serious vulnerabilities and commission penetration tests. All control owners are challenged and prepared to show evidence and reproduce controls. • Lead the response to security and privacy incidents, approve notifications to regulators, and make sure root causes lead to structural fixes. • Manage security risk in our supply chain, from onboarding new suppliers to the annual review of critical ones, in line with DORA. • Make sure our continuity and recovery arrangements are tested and hold up, together with Engineering. • Make security measurable. We judge it by how quickly and how structurally we resolve what we find, not by counting incidents. • Represent Ockto's security towards clients, auditors and supervisors: from a bank's due diligence questionnaire to our external audits and contact with DNB and AFM. • Build a security-aware culture with an awareness programme people actually remember. Who you work with You report to our Product & Trust Director, who sets Ockto's trust framework and risk appetite. Within that framework, the security strategy and its execution are yours. On security matters you also have a direct line to our CEO, and you are involved early in the product and architecture decisions that shape our risk. Our Information Security Officer is part of your team and runs day-to-day control monitoring with you. You also work closely with our Engineering Director and the value stream teams that build and run the Ockto platform. They operate the technical controls as the first line; you set the requirements, verify and challenge as the second. Outside Ockto, you work with the security, risk and procurement teams of our clients and with our external auditors. For audits you are the first line of planning, execution and communication with the auditor(s). Together with the Product & Trust Director, you are Ockto's security contact for DNB and AFM.