Head of Cyber Security

About the role

Fat Zebra, a payments platform serving merchants across Australia, is creating a dedicated Cyber Security function. As Head of Cyber Security you report directly to the Chief Technology Officer and lead a team of Cyber Security Engineers, owning cyber security across the business including security engineering and PCI DSS compliance. You will set the strategy, build the team and give the business a clear view of security risk as licensing and regulatory expectations grow. Interim security cover provided by contractors will move into your team.

Key responsibilities

• Set and deliver the cyber security strategy and roadmap aligned to business risk and regulatory requirements.
• Own PCI DSS compliance and ASAE 3150 controls assurance end to end, including scoping, control design, evidence and the annual assessment.
• Recruit, lead and develop the two Cyber Security Engineers and transition interim contractor cover into the team.
• Own security engineering: secure cloud architecture, vulnerability management, security tooling and secure development practices with engineering teams.
• Lead security incident response, including playbooks, exercises and coordination with Operations, SRE and executives during incidents.
• Maintain the security policy framework and cyber risk register, and report security posture to the CTO, executive team and board.
• Manage third-party and vendor security risk, including due diligence for new suppliers and partners.
• Support audits, card scheme requirements, bank partner reviews and customer security questionnaires.
• Build security awareness across the business, including phishing and secure-practice training.
• Prepare the security function for payments licensing and other emerging regulatory obligations, and act as the senior escalation point for security incidents, including out-of-hours involvement.

Required profile

• Significant cyber security experience, including leading a security function or team.
• Experience building a security function or programme from scratch, including hiring.
• Deep, practical knowledge of PCI DSS, ideally in a payments, fintech or financial services business.
• Track record of leading security incident response and building practical, risk-based controls.
• Ability to explain security risk clearly to executives and the board and to influence without slowing the business.

Required skills

• PCI DSS and ASAE 3150 compliance
• Frameworks such as ISO 27001, NIST CSF or the ASD Essential Eight
• Securing cloud-hosted platforms (e.g. AWS)
• Relevant certifications such as CISSP, CISM or PCI-related ones are a plus