[Hiring] Cybersecurity Lead @Coverflex

Role Description

The Cybersecurity Lead will help Coverflex grow as a trusted, resilient multi-market fintech. By identifying material risks earlier, strengthening security operations and third-party assurance, and making security evidence reusable, this role will protect customers and company data, support reliable payment and benefits services, preserve ISO 27001 and contractual commitments, and reduce friction in launches, enterprise sales, renewals, and audits.

You’ll know you’re successful if, after 90 days:

• 100% of material security risks have an owner, treatment decision, due date, and monthly review.
• A monthly dashboard and quarterly Management Team risk review are in place.
• All required ISMS, cybersecurity, and related privacy documentation has a named owner, review cadence, and current approved version.
• At least one executive risk exercise and one technical control validation are completed, with ≥90% of resulting actions closed by their due dates.
• ≥95% of critical/high vulnerabilities are remediated within policy SLA and all exceptions are formally approved and time-bound.
• 100% of defined high-risk changes receive a risk-based review before launch.
• 100% of critical suppliers are tiered and the highest-risk suppliers are assessed, with contractual and technical gaps tracked.

How we’ll measure success:

• Establish ownership and visibility: consolidate material security risks, findings, exceptions, critical suppliers, security actions, tooling, spend, and key-person dependencies.
• Own and maintain the core ISMS and cybersecurity documentation, including the Information Security Policy and Cybersecurity Risk Management Plan.
• Publish a risk-ranked 12-month roadmap and management dashboard.
• Privacy- and GDPR-specific documentation remains jointly coordinated with the DPO and Legal/Compliance, with explicit ownership agreed for each document.

Operationalise security governance and resilience:

• Clarify escalation roles, risk thresholds, control ownership, evidence requirements, vulnerability SLAs, and the risk-exception workflow.
• Run an executive risk exercise and technical control validation covering a critical payment partner.

Embed proportionate assurance into growth:

• Establish review gates for high-risk launches, architecture changes, and critical vendors.
• Introduce repeatable threat-modelling patterns.
• Tier critical third parties and track material gaps to closure.

Qualifications

• Senior, hands-on security experience in a regulated fintech, payments, SaaS, or similarly high-trust environment.
• Personally conducted security investigations, tuned detections, assessed cloud and identity controls, reviewed architectures, and validated vulnerability remediation.
• Strong cloud, application/product security, IAM, detection/response, vulnerability management, and third-party risk judgement.
• Experience owning ISO 27001 or comparable assurance while keeping the programme outcome-focused.
• Ability to build a proportionate security programme in a scaling company, not only operate within a mature enterprise function.
• Credibility with engineers and the ability to translate technical detail into clear business recommendations.
• Fluent professional English.

Requirements

• Experience with payment processors, card ecosystems, regulated partners, or multi-market fintech operations.
• Experience using managed security services and specialist providers effectively.
• Security automation and evidence-collection experience.
• Experience with executive risk exercises and supplier resilience scenarios.
• Relevant certifications such as CISSP, CISM, CCSP, OSCP, or ISO 27001 Lead Implementer/Auditor; practical evidence matters more than certificates.

Benefits

• All Coverflex benefits apply.

Company Description

Coverflex exists to make compensation work for everyone. We turn compensation into choice — one platform, one card, one app — for benefits, meal allowance, insurance and more. Our platform is simple for HR and meaningful for employees. We provide choice, smarter compensation tools and empowerment.