Make security the reason people trust OcktoOwn security at the platform people use to share their most personal dataEvery day, people use Ockto to share their identity, income, assets and bank data: when they apply for a mortgage, rent a home or take out a lease.
Banks and other large organisations choose Ockto partly because of the level of assurance we offer around that data.
At Ockto, security is not a support function.
It is part of the product and organisational culture.
As our CISO, you make sure it stays that way as we grow.
Part of that growth is adopting an AI driven operating model with strong guardrails.
You own Ockto's security programme, from risk and controls to incidents, suppliers and audits.
You set the standard, check that it is met, and make security measurable in a way that the whole organisation (and specifically our engineers and spec leads), clients, auditors and regulators all recognise.
You do this with a real mandate and short lines to the people who decide.
What you'll doYou own the information security programme of a supervised financial company and make it work in daily practice, not just on paper.
As CISO, you:Own Ockto's ISMS and security policy framework, and keep our ISO 27001 certification (held since 2017) and our SOC 2 assurance current and credible.
Translate the risk appetite set by management into a security strategy, an annual plan and clear standards that teams can build to.
You track developments such as eIDAS2 and the EU Digital Identity Wallet, NIS2, the Cyber Resilience Act and the AI Act, assess what they mean for Ockto and our clients, and translate them into our security strategy and standards in time.
Verify and challenge.
Our engineering teams operate the technical controls; you check that they work and that findings get fixed.
You approve risk acceptance for serious vulnerabilities and commission penetration tests.
All control owners are challenged and prepared to show evidence and r.