Head of Security

* Who we’re looking for: An experienced security leader who is as comfortable reviewing pen test results and SIEM output as briefing the board. You’ll have led the response to a major cyber incident and built security in a scaling, data-sensitive business, ideally in fintech or payments, and you can turn complex risks into clear, practical priorities.
* The challenge: Tillo is growing as a group, and our security needs to keep up. You’ll set and lead a group-wide security strategy, raising standards across our platforms, our cloud and our acquired businesses, and you’ll lead the response if a serious security incident happens __
* Where you’ll work: This role will be based in Cape Town office 3 days per week, you’ll be part of our global team, collaborating with colleagues and serving customers across the UK, USA, Australia, South Africa, Italy and beyond.
[The Tillo Difference](https://www.tillo.io/the-tillo-difference)
We're in the business of rewards and incentives, so we know a thing or two about the importance of giving back. We can't grow as a business without growing as individuals, so we are committed to providing a workplace where passionate, driven individuals can thrive. We value collaboration, trust, positivity, and a willingness to learn - only by working as a team will we reach our goals.
We’re the market leader in the UK and are active in a number of other markets including USA, Europe, Australia and India.
Key responsibilities
------------------------
Security Strategy & Risk Management
* Develop and implement a group-wide information security strategy and roadmap.
* Assess current vulnerabilities, prioritise risks and establish clear ownership of remediation.
* Own the security risk framework and risk appetite, and be accountable for the risk register (maintained by the Information Security Manager), reporting framework and control environment.
* Embed security by design across software development, infrastructure, cloud services and business Systems. Working with Engineering, define and roll out proportionate security gates across the group’s development lifecycle: threat modelling for significant changes at design stage, automated code, dependency and secrets scanning in CI.
* Establish proportionate security policies, standards and controls without creating unnecessary bureaucracy.
Security Incident Response, Business Continuity and Recovery
* Act as incident lead for significant security incidents, directing investigation, containment, remediation and recovery.
* Ensure root-cause analysis is completed and lessons learned are translated into practical security improvements.
* Own the incident response plan, escalation protocols and crisis management procedures. Technical response is led by the Security Engineer; the incident log, root-cause analysis and corrective actions are tracked by the Information Security Manager.
* Own business continuity and disaster recovery plans for critical services, including regular testing against agreed recovery time and recovery point objectives.
* Coordinate with internal technology teams, external incident response specialists, forensic investigators, legal advisers and relevant stakeholders.
* Ensure appropriate evidence preservation, incident documentation and timely escalation of material risks.
* Work with legal and privacy specialists to assess notification obligations to regulators, customers and other affected parties.
Technical Security and Infrastructure
* Own identity and privileged access risk, working with the IT Manager, whose team operates the identity platforms, to improve privileged access, authentication and access reviews.
* Strengthen cloud, network, endpoint, application and infrastructure security.
* Improve vulnerability management, patching, penetration testing and security monitoring.
* Evaluate and implement appropriate detection, logging, alerting and response capabilities.
* Oversee supplier security risk, with assessments carried out by the Information Security Manager, and review integrations, APIs and other potential attack surfaces.
* Work with engineering and IT teams to improve secure development practices and operational resilience.
* Own the security of the group’s customer facing platforms against abuse, including bot activity, scraping, credential stuffing and API misuse. Set and maintain controls such as WAF rules, rate limiting and bot management, and work with Product and Platform, who own fraud rules and fraud losses, through an agreed handoff for detection, escalation and response.
* Own the security standards for customer and partner access to group platforms, working with Engineering, who build and run them. This includes API key and token issuing, rotation and revocation, IP allowlisting for API buyers, and role based access and permissions in customer facing tools such as the Management Hub.
Governance, risk and compliance
* Be accountable for the group ISMS and relevant security frameworks, such as ISO 27001, NIS2 and Cyber Essentials Plus, and applicable payment security requirements, including extending certification scope to acquired businesses.
* Oversee customer security assessments, due diligence, audits and contractual security commitments, providing senior sign-off and escalation.
* Oversee the security awareness programme across the group.
* Work closely with Legal, Risk/Compliance, Engineering, IT and commercial teams.
* Ensure data protection and privacy requirements are addressed in partnership with relevant specialists.
Strategy and leadership
* Set and maintain the information security strategy and roadmap, aligned to business goals and risk appetite.
* Lead and develop the security team, hire to build out capability, and manage the security budget.
* Own the group's security vendor relationships, such as CrowdStrike and Cloudflare, and managed detection and response, penetration testing and incident response partners. This includes evaluating and selecting new vendors, commercial negotiation and renewals, and holding vendors to agreed service levels.
* Own security reporting on posture, risks and incidents to the executive team, Cyber Committee and board.
What we are looking for
---------------------------
Essential
* Significant experience in information security, cybersecurity or security engineering, ideally in a senior Security Lead, Head of Security or equivalent role.
* Proven experience leading or coordinating the response to a major security breach or cyber incident, including containment, recovery, investigation and remediation.
* Strong technical understanding of modern cloud-based technology environments, SaaS platforms, APIs, identity management and enterprise infrastructure.
* Experience building or materially improving security controls in a scaling technology, fintech, payments or other data-sensitive business.
* Ability to assess complex technical risks and translate them into clear business priorities.
* Experience working with executive teams and communicating security risks confidently to non-technical stakeholders.
* Demonstrable experience implementing security monitoring, incident response, vulnerability management and disaster recovery capabilities.
* Hands on application and API security experience, such as secure code review, threat modelling and the OWASP Top 10 and API Security Top 10, with the credibility to challenge engineering teams on design and code
* A pragmatic, hands-on approach, with the credibility to challenge technical teams and drive urgent change.
Desirable
* Experience in fintech, payments, financial services or other environments with high customer and data security requirements.
* Experience across multiple businesses, acquired companies or complex technology environments.
* Knowledge of ISO 27001, SOC 2, NIS2, PCI DSS where applicable, GDPR and r