SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Obligo, a fintech company using open banking and AI to simplify trust between renters and landlords, is seeking a Head of Security, IT & AI Governance to own security and IT end-to-end. You will set strategy, lead the team, and work hands-on to deploy, configure, investigate and respond to incidents yourself.
Key responsibilities include:
**Security & IT Strategy**: Define and execute a multi-year security and IT roadmap, manage budget and scorecards, and communicate risk clearly to leadership, customers and auditors.
**AI Security & Governance**: Build and improve the AI security program covering both employee use of AI tools (approved-tool lists, shadow-AI discovery, data-leakage controls) and AI built into the product (prompt injection, sensitive-data disclosure, AI agent agency, supply-chain risk, vector/RAG data exposure). Align with OWASP LLM Top 10, NIST AI RMF and ISO 42001.
**Security Monitoring & Zero Trust**: Continuously improve detection, response and access security across AWS, Google Workspace, endpoints and SaaS. Work hands-on with SIEM and SASE/Zero Trust technologies to refine logging, detection rules, alert triage and incident response. Strengthen access and data protection through SSO/MFA, device posture, ZTNA, SWG, CASB and DLP.
**Compliance & SOC 2**: Own SOC 2 readiness, audits and continuous monitoring using Drata. Be the primary security contact for customer due diligence and questionnaires.
**Cloud & Application Security**: Harden AWS and Google Workspace, manage vulnerability management, conduct annual penetration tests, perform secure code review, manage secrets and IAM hygiene, and embed security in the SDLC with R&D.
**IT Operations**: Own employee onboarding/offboarding, device management and hardening, software procurement, and IT ticketing with clear SLAs.
**Vendor & Third-Party Risk**: Run security reviews of vendors and third parties, including AI vendors, and maintain current vendor inventory.
**Security Awareness**: Run an ongoing security awareness program including phishing simulations and training.
**Risk Leadership**: Serve as the primary technology-risk voice on the Obligo Risk Committee, working with R&D, Legal and Operations leadership.
You will grow the team (currently a SecOps engineer and external IT company) and manage vendors while maintaining hands-on involvement in investigation, detection writing, automation, tooling configuration and incident response.
**Requirements**:
- 5+ years in security and IT, including 2+ years in a leadership role at a cloud-native, fast-growing company (fintech or SaaS preferred)
- Proven, hands-on experience implementing SIEM tools (Splunk, Sentinel, Elastic, Wazuh, Panther, Sumo Logic) and SASE/modern Zero Trust stacks including ZTNA/SWG (Zscaler, Netskope, Cloudflare, Palo Alto Prisma)
- Deep, current knowledge of AI security risks and controls for both employee use of AI and AI-powered products, including agentic AI and LLM-specific threats
- Direct experience leading SOC 2 (Type II) readiness and audits end-to-end, ideally with compliance automation platforms; ISO 27001, PCI or similar a plus
- Strong AWS and Google Workspace security background: IAM, network, logging, endpoint management (MDM/EDR) and SSO/MFA
- Real management skills: led technical people and equally comfortable working hands-on
- Excellent English communication; able to translate risk into business language for executives, auditors and customers
- Calm under pressure, structured, ownership-driven, comfortable with ambiguity in startup environment
**Nice to have**: Relevant certifications (CISSP, CISM, CCSP, OSCP, AWS Security Specialty, AI security certifications), security automation and scripting experience, regulated financial environment experience.
