Head of Security

1. Security Testing & Programme Leadership

• Design, plan, and execute full-scope security testing engagements (network, application, cloud, social engineering awareness, physical) against dtcpay's production and pre-production environments.
• Develop and maintain simulation and testing plans aligned with recognised industry frameworks and regulatory threat intelligence guidance (e.g. MITRE ATT&CK-informed methodology, TIBER-EU, MAS TPRM).
• Lead collaborative exercises with the Security Operations team and internal defence functions to validate detection and response controls.
• Manage the end-to-end vulnerability disclosure programme, triaging findings and coordinating remediation timelines with engineering.
• Maintain the security testing infrastructure and tooling to production-safe standards.

2. People & Team Management

• Hire, mentor, and retain a high-performing team of Security Testing Specialists, Penetration Testers, and Threat Intelligence Analysts.
• Define career paths, training budgets, and certification goals (e.g. OSCP, OSED, CRTO, PNPT, GXPN).
• Foster a culture of continuous learning, responsible disclosure, and professional ethics.
• Conduct regular skills assessments and rotate team members across specialisations (web, mobile, OT/IoT, cloud).

3. Technology Risk Management & Governance

• Translate security testing findings into structured risk statements aligned with dtcpay's enterprise risk framework (ISO 31000, NIST RMF).
• Interface with the GRC team to update the risk register, contribute to board-level risk dashboards, and provide evidence of remediation for auditors.
• Define and track KPIs / KRIs for the security testing function: mean time to detect (MTTD), mean time to respond (MTTR), and risk-exposure-reduction metrics.
• Participate in third-party and supply-chain risk assessments for critical technology vendors.
• Represent the security testing function in change-advisory and architecture review processes.

4. Regulatory Compliance & Privacy Requirements

• Ensure all security testing activities are conducted within legal and regulatory boundaries across all operating jurisdictions, including obtaining appropriate written authorisations.
• Advise on security controls required to meet obligations under MAS TRM, PDPA, GDPR, UK GDPR, PDPD, and related frameworks.
• Collaborate with Legal and the DPO to ensure any personal data encountered during testing is handled, minimised, and destroyed in compliance with applicable data-protection laws.
• Contribute to regulatory engagement: respond to MAS, ICO, and supervisory authority queries; prepare evidence packs for technology-risk examinations.
• Track regulatory developments and proactively update engagement rules of engagement and testing policies.

5. Reporting & Stakeholder Communication

• Produce executive-level and technical reports with clear risk ratings (CVSS, DREAD), business-impact narratives, and prioritised remediation roadmaps.
• Present findings to the CISO, CTO, and Risk Committee; tailor communication to both technical and non-technical audiences.
• Maintain a historical findings database to trend residual risk over time and demonstrate programme maturity.

What We're Looking For

• 8+ years of hands-on security testing experience, with at least 3 years in a team leadership or management capacity.
• Demonstrated expertise in simulation-based security testing and penetration testing across web applications, cloud (AWS/Azure/GCP), mobile (iOS/Android), APIs, and internal networks.
• Proven experience operating within a regulated financial-services or payment-industry environment.
• Deep working knowledge of MAS TRM Guidelines, UK GDPR / FCA Operational Resilience, GDPR, and DORA.
• Proficiency in industry-standard security testing tools and frameworks, including custom tooling development (Python, C#, PowerShell).
• Familiarity with cloud-native security risks (IAM misconfiguration, SSRF, container escape, serverless exposure).
• Exceptional written and verbal communication; ability to present technical risk findings to senior executives and board members.
• Bachelor's degree or higher in Computer Science, Information Security, or equivalent.

Preferred Certifications

• Technical Security Testing: OSCP / OSED / OSWE / OSMR, CRTO / CRTE, GXPN, PNPT, CCT INF / CRT
• Governance & Risk: CISSP, CISM, CRISC, CDPSE, CIPP/A or CIPP/E
• Cloud: AWS Security Specialty, Azure Security Engineer, Google PCSE

Preferred Experience

• Experience with TIBER-EU or iCAST (MAS Intelligence-led Cyber Attack Simulation Testing) engagements.
• Prior engagement with regulators (MAS, ICO, BNM, FCA) on technology-risk or security incidents.
• Exposure to digital-asset custody, or infrastructure security testing.
• Experience building or scaling a security testing programme from the ground up.