requirements (including Australian financial services regulations, SOC 2 Type II, and UK GDPR) - working closely with the regional compliance managers for each geography. Policy direction and sign-off is owned by the co-CEOs. Support Open in maintaining and maturing the security risk register - owning operational reporting and translating security risk into business language for senior leadership team reporting. Drive the operational programme behind our SOC 2 Type II certification, maintaining audit readiness and compliance as the business scales. Own the vendor assessment programme: requesting, reviewing, and managing assessments using our GRC tooling and established AU/UK templates, escalating exceptions to the Founder’s Office and Executive Team as needed. Own Open's data classification and DLP policy framework: defining standards for sensitive data handling across AU and UK operations, with Technology owning tooling enforcement. Own Open's AI governance framework for an environment where everyone is a builder: training data classification, customer-facing AI risk (prompt injection, jailbreaks, content safety), and secure use of GenAI tooling and AI coding assistants. Build on existing security awareness initiatives: extending phishing campaigns and team training to include a developer security programme, with a particular focus on secure use of GenAI across engineering, data, and the wider business. Maintain the sub-processor register and change-notification process in line with DPA commitments - co-owned with the regional compliance managers. Partner & Customer Security Own the end-to-end partner and carrier security assessment process: responding to SIG, VSA, and bespoke due diligence requests across AU and UK, and reducing the commercial friction that assessment delays create. Build and maintain a response library and evidence packs in our GRC platform - enabling faster, consistent turnaround across AU and UK partner requests. Work closely with commercial and partnerships teams to anticipate security
requirements early in partner onboarding - getting ahead of requests rather than reacting to them. Own the security input to Data Processing Agreements with partners, carriers, and customers. This includes defining and maintaining Open's Technical and Organisational Measures, supporting sub-processor disclosures, and contributing the security view to Transfer Risk Assessments under UK GDPR. Work alongside Legal and the regional compliance managers, who own contract negotiation and broader privacy compliance respectively. Security Standards & Architecture Maintain and evolve security standards and architecture principles across the technology estate in partnership with the Head of TechOps - raising the bar across the technology estate and ensuring the Head of TechOps, data, and engineering squads implement to standard. Lead threat modelling and security design reviews for new products, features, and architectural changes, in collaboration with engineering, data and DevOps. Establish governance over cloud security posture findings: defining triage processes, remediation SLAs, and escalation criteria across our CSPM (Cloud Security Posture Management) and observability tooling. Maintain the AppSec programme: penetration testing cadence, vulnerability disclosure support, and remediation SLAs; with TechOps owning tooling execution. Vulnerability disclosure is managed at C-level; this role supports and feeds into that process. Define network security standards and zero trust principles across Open's technology estate, in collaboration with the Head of TechOps. Contribute to secure coding standards, with specific focus on GenAI-assisted development practices and the secure use of AI coding tools across engineering, data, and the wider business. Security Operations Evaluate and recommend an external SOC provider: assess options, define scope, SLAs, and escalation paths, and present a recommendation to the Founder’s Office and Executive Team for decision. Own the ongoing SOC relationship post-onboarding, continuously reviewing and improving monitoring, detection, and response quality. Serve as the operational lead for incident response - coordinating internally and managing the response process, with escalation to the Founder’s Office and Executive Team for significant security events requiring executive involvement or external communication. Maintain and test incident response and business continuity playbooks in collaboration with the Head of TechOps, data and engineering teams. Ensure logging, alerting, and detection capabilities across our cloud platforms (e.g. AWS, Snowflake, etc) are appropriate to the threat landscape. Leadership & Influence Build the security function's roadmap and communicate it clearly at every level, from engineers to the senior leadership team. Influence how engineering, data, and TechOps teams approach security - through standards, design reviews, and ongoing collaboration rather than direct authority. Foster a culture of psychological safety, candour, and continuous improvement across the teams you work with. Who this role isn't for This is a broad, commercially-oriented security role in a lean, high-trust environment. It rewards people who are energised by ownership and ambiguity - not those looking for a defined lane or a large team to lead. Specifically, it's probably not the right fit if: You're coming from a large enterprise security function and are looking for a similar structure, support team, or delegation model: this role is hands-on by design. Your background is primarily audit, compliance, or governance and you haven't worked closely with engineering or DevOps teams: technical credibility with builders is essential here. You're an AppSec or security engineering specialist looking to step up: the majority of the workload is governance, partner-facing, and commercial, not technical execution. You're motivated primarily by growing a team: the function is intentionally lean, and that's unlikely to change significantly in the near term. You're looking for a purely advisory remit: this role owns outcomes, not recommendations. What you'll bring Required Proven experience in a senior security role in a technology or scale-up environment. Strong governance and compliance background across ANZ and/or UK regulatory frameworks, including policy maintenance and security risk reporting. AI-forward security mindset - you understand the risk landscape around GenAI, LLMs, and AI-assisted development, and can build governance frameworks that enable rather than block. Sufficient technical depth to contribute credibly to security standards, lead threat modelling, and ensure engineering and data teams are working to standard - without needing to own the tooling. Experience evaluating or managing an external SOC: detection scope, incident response, and escalation. Experience owning partner and customer security assessments at a commercial level - SIG, VSA, and bespoke due diligence. Confident communicator from engineer to senior stakeholder - you translate risk into business language and can uplift security literacy across a leadership team. Comfortable operating collaboratively alongside Engineering, Data, and TechOps - effective without direct authority over those functions. Solid understanding of AWS security, DevSecOps practices, and secure SDLC principles. Practical experience contributing to DPAs and TOMs in a B2B context — comfortable working alongside legal and privacy counterparts on partner contracts. Experience operating a sub-processor register and change-notification process in a B2B SaaS or regulated context. Preferred Relevant certification: CISSP, CISM, CRISC, CCSP, or equivalent. Familiarity with Cyber Essentials Plus or equivalent UK security certification frameworks. Experience with cloud security posture management tooling (e.g. Wiz, or equivalent). Experience with SIEM or security observability tooling (e.g. Datadog, GuardDuty, or equivalent). Experience operating across multiple geographies (ANZ and UK, or equivalent). Exposure to the insurance, fintech, or regulated financial services sector. Degree in Computer Science, Information Security, or a related field Role location Where you'll work This role is based in Sydney, Australia. We work in a hybrid model, with teams in the office on Mondays, Tuesdays, and Thursdays. We've found this rhythm genuinely supports collaboration and the kind of fast, high-trust culture we've built. You'll have flexibility on the other days to work in a way that suits you. Why Open? Open is on a mission to make it easy for everyone to get the most from their insurance. Insurance is one of the world’s least digitally mature industries - for years it’s remained confusing, paper-based and heavily intermediated. We launched in 2016 to build a global, AI-powered platform that digitises the entire insurance process, making it transparent, less costly and more reliable. It’s an exciting time to join Open and be part of a tech scale-up. We provide our team with: Highly competitive
