Head of Security

About this role

Head of Security

Company: Aptitude Software

Reports to: Chief Product and Technology Officer (CPTO)

Type: Permanent, full time

Direct reports: Four at appointment, with scope to grow the team incrementally through 2027

Aptitude Software builds finance and accounting software for large, regulated organisations: banks, insurers, telecoms operators and other enterprises that run their financial record-keeping on our platforms. Our flagship product, Fynapse, is a cloud-native accounting platform running on Kubernetes across AWS and Azure. Alongside it we run an established portfolio of accounting, revenue recognition, lease accounting and insurance calculation products, deployed both as SaaS and on-premise at customer sites, and a subscription billing and payments business that handles payment card data.

Our customers are among the most security-conscious buyers in the market. They audit us, question us, hold us to their own patching and remediation expectations, and increasingly ask how we support their obligations under operational resilience regulation such as DORA. Security is a condition of doing business for us.

The role

You will own security at Aptitude Software: product and cloud security, internal and corporate security, governance, risk and compliance, third-party and vendor security, business continuity and disaster recovery, and the security tooling estate. You will build these into one function with one owner, one set of priorities and one source of truth, and you will be the person our customers, auditors, executive team and board look to for a straight answer on where we stand.

You report to the CPTO and sit within the technology leadership team alongside the Head of Engineering, Head of Product and Head of Business Technology.

Responsibilities*

Security leadership and strategy

• Define and own the security strategy and roadmap for Aptitude Software, agreed with the CPTO and reported to the executive team and board.
• Establish clear, simple security metrics and report them regularly
• Own the information security risk register and the information security committee agenda
• Own security policy end to end, including the vulnerability management, version support and secure development policies.
• Own security budget and spend, and make the case for investment where it is needed.

Product and cloud security

• Own security across the product estate: Fynapse on AWS and Azure, the established accounting products on AWS and at customer sites, and the payments platform.
• Set the standard for secure design, secure build and release gating, and work with engineering leadership to embed it in the delivery pipeline rather than bolt it on at the end.
• Run vulnerability management as a single process across all products, from detection through triage, remediation and customer communication, and close the coverage gaps where some products are today outside the standard tooling.

Governance, risk and compliance and vendor management

• Own ISO 27001, SOC 1, SOC 2 and PCI DSS compliance, the audit calendar, the compliance automation platform and the relationship with our auditors.
• Work with legal and the Data Protection Officer function on data protection, data residency, sub-processor oversight and customer contractual security commitments.

Business continuity and disaster recovery

• Own the business continuity and disaster recovery programme, including the annual test schedule, tabletop exercises and the remediation that follows them.
• Make sure recovery is tested to improve resilience, not only to satisfy an audit.

Team leadership

• Lead, develop and retain a team of four security professionals spanning cloud and product security operations, security controls and compliance, security programme management, and engineering operations tooling.

Working with technology leadership*

• Act as a sparring partner to the CPTO, the Head of Engineering and the architects: challenge design decisions, argue for the right trade-offs between delivery and risk, and be prepared to be challenged back.
• Contribute to the technology strategy, including the multi-year migration of customers from our established products to Fynapse, so that security is designed into that journey.

What we are looking for

Essential

• A career in security. You have worked hands-on in technical security roles before leading them and are fluent in the concepts: threat modelling, vulnerability management, cloud security architecture, identity and access, secure software development, detection and response.
• Experience leading a security team, including line management, development and retention of specialists. You do not need to have managed managers.
• Experience running security in a software or SaaS company serving regulated enterprise customers, and of facing those customers on security matters.
• Working knowledge of ISO 27001 and SOC 2, and experience of being accountable for audits and certifications. PCI DSS experience is an advantage.
• Practical understanding of cloud security on AWS and Azure, Kubernetes-based platforms, infrastructure as code and modern CI/CD.
• Experience owning or running third-party and vendor risk management.
• The judgement to distinguish theoretical from practical risk and to prioritise accordingly.
• Clear, direct communication in writing and in person.

What success looks like in the first year

• Security is one function with one owner, a clear structure and a published roadmap.
• The vulnerability management and version support policies are fully embedded, and remediation times against them are measured and reported.
• Every product sits within the standard security tooling and monitoring estate.
• Critical knowledge and privileged access are held by more than one person.
• Customers, auditors and the board receive regular, consistent reporting on our security position, and account teams have a defined position to take to customers on patching and support.

About security roles for ex-police

Security management, operations and consultancy roles. Years of operational policing — command, incident response, public order — translate directly into corporate security, and employers in this sector actively rate police experience.