{"id":862241,"url":"https://alion.io/job/aptitude-software-head-of-security","title":"Head of Security","company":{"id":184152,"name":"Aptitude Software","domain":"aptitudesoftware.com","url":"https://alion.io/company/aptitude-software","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Recruitee","truth_index":null},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":126000,"max_usd":232000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":61},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-09-11T14:21:05Z","employer_posted_date":"2026-09-11","last_verified_at":"2026-10-18T08:59:06Z","board_verified":true,"closed_at":null,"days_open":36,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":36},"description":"Head of Security\nCompany: Aptitude Software\nReports to: Chief Product and Technology Officer (CPTO)\nLocation: London, hybrid. The security team is split across the UK and Poland.\nType: Permanent, full time\nDirect reports: Four at appointment, with scope to grow the team incrementally through 2027\nAptitude Software builds finance and accounting software for large, regulated organisations: banks, insurers, telecoms operators and other enterprises that run their financial record-keeping on our platforms. Our flagship product, Fynapse, is a cloud-native accounting platform running on Kubernetes across AWS and Azure. Alongside it we run an established portfolio of accounting, revenue recognition, lease accounting and insurance calculation products, deployed both as SaaS and on-premise at customer sites, and a subscription billing and payments business that handles payment card data.\nOur customers are among the most security-conscious buyers in the market. They audit us, question us, hold us to their own patching and remediation expectations, and increasingly ask how we support their obligations under operational resilience regulation such as DORA. Security is a condition of doing business for us.\nThe role\nYou will own security at Aptitude Software: product and cloud security, internal and corporate security, governance, risk and compliance, third-party and vendor security, business continuity and disaster recovery, and the security tooling estate. You will build these into one function with one owner, one set of priorities and one source of truth, and you will be the person our customers, auditors, executive team and board look to for a straight answer on where we stand.\nYou report to the CPTO and sit within the technology leadership team alongside the Head of Engineering, Head of Product and Head of Business Technology.\nResponsibilities\nSecurity leadership and strategy\nDefine and own the security strategy and roadmap for Aptitude Software, agreed with the CPTO and reported to the executive team and board.\n\nEstablish clear, simple security metrics and report them regularly\n\nOwn the information security risk register and the information security committee agenda\n\nOwn security policy end to end, including the vulnerability management, version support and secure development policies.\n\nOwn security budget and spend, and make the case for investment where it is needed.\n\nProduct and cloud security\nOwn security across the product estate: Fynapse on AWS and Azure, the established accounting products on AWS and at customer sites, and the payments platform.\n\nSet the standard for secure design, secure build and release gating, and work with engineering leadership to embed it in the delivery pipeline rather than bolt it on at the end.\n\nRun vulnerability management as a single process across all products, from detection through triage, remediation and customer communication, and close the coverage gaps where some products are today outside the standard tooling.\n\nGovernance, risk and compliance and vendor management\nOwn ISO 27001, SOC 1, SOC 2 and PCI DSS compliance, the audit calendar, the compliance automation platform and the relationship with our auditors.\n\nWork with legal and the Data Protection Officer function on data protection, data residency, sub-processor oversight and customer contractual security commitments.\n\nBusiness continuity and disaster recovery\nOwn the business continuity and disaster recovery programme, including the annual test schedule, tabletop exercises and the remediation that follows them.\n\nMake sure recovery is tested to improve resilience, not only to satisfy an audit.\n\nTeam leadership\nLead, develop and retain a team of four security professionals spanning cloud and product security operations, security controls and compliance, security programme management, and engineering operations tooling.\n\nWorking with technology leadership\nAct as a sparring partner to the CPTO, the Head of Engineering and the architects: challenge design decisions, argue for the right trade-offs between delivery and risk, and be prepared to be challenged back.\n\nContribute to the technology strategy, including the multi-year migration of customers from our established products to Fynapse, so that security is designed into that journey.\n\nWhat we are looking for\nEssential\nA career in security. You have worked hands-on in technical security roles before leading them and are fluent in the concepts: threat modelling, vulnerability management, cloud security architecture, identity and access, secure software development, detection and response.\n\nExperience leading a security team, including line management, development and retention of specialists. You do not need to have managed managers.\n\nExperience running security in a software or SaaS company serving regulated enterprise customers, and of facing those customers on security matters.\n\nWorking knowledge of ISO 27001 and SOC 2, and experience of being accountable for audits and certifications. PCI DSS experience is an advantage.\n\nPractical understanding of cloud security on AWS and Azure, Kubernetes-based platforms, infrastructure as code and modern CI/CD.\n\nExperience owning or running third-party and vendor risk management.\n\nThe judgement to distinguish theoretical from practical risk and to prioritise accordingly.\n\nClear, direct communication in writing and in person.\n\nWhat success looks like in the first year\nSecurity is one function with one owner, a clear structure and a published roadmap.\n\nThe vulnerability management and version support policies are fully embedded, and remediation times against them are measured and reported.\n\nEvery product sits within the standard security tooling and monitoring estate.\n\nCritical knowledge and privileged access are held by more than one person.\n\nCustomers, auditors and the board receive regular, consistent reporting on our security position, and account teams have a defined position to take to customers on patching and support.","description_format":"text","description_chars":6008,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["ERP & Business Management Software","Accounting & Tax Software"],"lifecycle":[{"event":"open","at":"2026-09-13T10:46:27Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Senior or Specialist Worker, Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Global Business Mobility: Senior or Specialist Worker; Skilled Worker","cap_exempt":false,"checked_at":"2026-10-17T06:21:15+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":33,"band":"fade","label":"Fading","p_open":1,"p_active":0.732,"p_room":0.45,"age_days":35,"expected_fill_days":19,"reasons":["conf:1","urgency","win:tail"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/aptitude-software-head-of-security","json_url":"https://alion.io/job/aptitude-software-head-of-security.json","meta":{"generated_at":"2026-10-18T12:41:02Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18744,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":184152},"rest":"https://alion.io/mcp/rest/get_company?id=184152"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faptitude-software-head-of-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faptitude-software-head-of-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faptitude-software-head-of-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/aptitude-software-head-of-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faptitude-software-head-of-security"}]}