London, England, United Kingdom
At Aptitude, we’re on a mission to change the way the world’s leading enterprises understand and grow their businesses. Our industry-leading finance data platform, Fynapse, helps organizations streamline their operations, unlock trusted insights and accelerate growth.
We’re proud to be building a global team of passionate and ambitious people who love solving complex challenges and making an impact. We celebrate diverse perspectives and believe that our differences make us stronger, smarter and more creative.
With our headquarters in London and offices in seven locations worldwide, we’re proud to partner with clients across four continents. Wherever you join us, you’ll be part of a global community shaping the next generation of finance technology.
Company: Aptitude Software
Reports to: Chief Product and Technology Officer (CPTO)
Location: London, hybrid. The security team is split across the UK and Poland.
Type: Permanent, full time
Direct reports: Four at appointment, with scope to grow the team incrementally through 2027
Aptitude Software builds finance and accounting software for large, regulated organisations: banks, insurers, telecoms operators and other enterprises that run their financial record-keeping on our platforms. Our flagship product, Fynapse, is a cloud-native accounting platform running on Kubernetes across AWS and Azure. Alongside it we run an established portfolio of accounting, revenue recognition, lease accounting and insurance calculation products, deployed both as SaaS and on-premise at customer sites, and a subscription billing and payments business that handles payment card data.
Our customers are among the most security-conscious buyers in the market. They audit us, question us, hold us to their own patching and remediation expectations, and increasingly ask how we support their obligations under operational resilience regulation such as DORA. Security is a condition of doing business for us.
You will own security at Aptitude Software: product and cloud security, internal and corporate security, governance, risk and compliance, third-party and vendor security, business continuity and disaster recovery, and the security tooling estate. You will build these into one function with one owner, one set of priorities and one source of truth, and you will be the person our customers, auditors, executive team and board look to for a straight answer on where we stand.
You report to the CPTO and sit within the technology leadership team alongside the Head of Engineering, Head of Product and Head of Business Technology.
Define and own the security strategy and roadmap for Aptitude Software, agreed with the CPTO and reported to the executive team and board.
Establish clear, simple security metrics and report them regularly
Own the information security risk register and the information security committee agenda
Own security policy end to end, including the vulnerability management, version support and secure development policies.
Own security budget and spend, and make the case for investment where it is needed.
Own security across the product estate: Fynapse on AWS and Azure, the established accounting products on AWS and at customer sites, and the payments platform.
Set the standard for secure design, secure build and release gating, and work with engineering leadership to embed it in the delivery pipeline rather than bolt it on at the end.
Run vulnerability management as a single process across all products, from detection through triage, remediation and customer communication, and close the coverage gaps where some products are today outside the standard tooling.
Own ISO 27001, SOC 1, SOC 2 and PCI DSS compliance, the audit calendar, the compliance automation platform and the relationship with our auditors.
Work with legal and the Data Protection Officer function on data protection, data residency, sub-processor oversight and customer contractual security commitments.
Own the business continuity and disaster recovery programme, including the annual test schedule, tabletop exercises and the remediation that follows them.
Make sure recovery is tested to improve resilience, not only to satisfy an audit.
Lead, develop and retain a team of four security professionals spanning cloud and product security operations, security controls and compliance, security programme management, and engineering operations tooling.
Act as a sparring partner to the CPTO, the Head of Engineering and the architects: challenge design decisions, argue for the right trade-offs between delivery and risk, and be prepared to be challenged back.
Contribute to the technology strategy, including the multi-year migration of customers from our established products to Fynapse, so that security is designed into that journey.
A career in security. You have worked hands-on in technical security roles before leading them and are fluent in the concepts: threat modelling, vulnerability management, cloud security architecture, identity and access, secure software development, detection and response.
Experience leading a security team, including line management, development and retention of specialists. You do not need to have managed managers.
Experience running security in a software or SaaS company serving regulated enterprise customers, and of facing those customers on security matters.
Working knowledge of ISO 27001 and SOC 2, and experience of being accountable for audits and certifications. PCI DSS experience is an advantage.
Practical understanding of cloud security on AWS and Azure, Kubernetes-based platforms, infrastructure as code and modern CI/CD.
Experience owning or running third-party and vendor risk management.
The judgement to distinguish theoretical from practical risk and to prioritise accordingly.
Clear, direct communication in writing and in person.
Security is one function with one owner, a clear structure and a published roadmap.
The vulnerability management and version support policies are fully embedded, and remediation times against them are measured and reported.
Every product sits within the standard security tooling and monitoring estate.
Critical knowledge and privileged access are held by more than one person.
Customers, auditors and the board receive regular, consistent reporting on our security position, and account teams have a defined position to take to customers on patching and support.
Please click on the ‘Apply now’ button below, including your CV/resume and any other relevant information that will help us get to know you better.
If you’re interested in working at Aptitude, but don’t feel you meet every single requirement of the role, we’d still like to hear from you! A diverse workforce is an essential part of our culture, and we’re dedicated to ensuring that our staff can show up as their authentic self – safe in the knowledge that their differences will be embraced and respected by all. We’re strong advocates of supporting applicants from a wide variety of backgrounds which include different ages, genders, ethnicities, physical abilities and sexual orientation, and we work hard to build the confidence of our workforce through inclusivity, equity and ongoing training. So, if you’re excited about this role but your past experience doesn’t align perfectly with every requirement, we’d encourage you to apply anyway. You might be just the candidate we’ve been looking for, whether it’s for this role or another.