Head of Security

• Who we’re looking for: An experienced security leader who is as comfortable reviewing pen test results and SIEM output as briefing the board. You’ll have led the response to a major cyber incident and built security in a scaling, data-sensitive business, ideally in fintech or payments, and you can turn complex risks into clear, practical priorities. 🌟

• The challenge: Tillo is growing as a group, and our security needs to keep up. You’ll set and lead a group-wide security strategy, raising standards across our platforms, our cloud and our acquired businesses, and you’ll lead the response if a serious security incident happens _🚀_

• Where you’ll work: This role will be based in Cape Town office 3 days per week, you’ll be part of our global team, collaborating with colleagues and serving customers across the UK, USA, Australia, South Africa, Italy and beyond. 🏢

[The Tillo Difference](https://www.tillo.io/the-tillo-difference)

We're in the business of rewards and incentives, so we know a thing or two about the importance of giving back. We can't grow as a business without growing as individuals, so we are committed to providing a workplace where passionate, driven individuals can thrive. We value collaboration, trust, positivity, and a willingness to learn - only by working as a team will we reach our goals.

We’re the market leader in the UK and are active in a number of other markets including USA, Europe, Australia and India. 🌎

Key responsibilities

------------------------

Security Strategy & Risk Management

• Develop and implement a group-wide information security strategy and roadmap.

• Assess current vulnerabilities, prioritise risks and establish clear ownership of remediation.

• Own the security risk framework and risk appetite, and be accountable for the risk register (maintained by the Information Security Manager), reporting framework and control environment.

• Embed security by design across software development, infrastructure, cloud services and business Systems. Working with Engineering, define and roll out proportionate security gates across the group’s development lifecycle: threat modelling for significant changes at design stage, automated code, dependency and secrets scanning in CI.

• Establish proportionate security policies, standards and controls without creating unnecessary bureaucracy.

Security Incident Response, Business Continuity and Recovery

• Act as incident lead for significant security incidents, directing investigation, containment, remediation and recovery.

• Ensure root-cause analysis is completed and lessons learned are translated into practical security improvements.

• Own the incident response plan, escalation protocols and crisis management procedures. Technical response is led by the Security Engineer; the incident log, root-cause analysis and corrective actions are tracked by the Information Security Manager.

• Own business continuity and disaster recovery plans for critical services, including regular testing against agreed recovery time and recovery point objectives.

• Coordinate with internal technology teams, external incident response specialists,...

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis.