Chief Information Security Officer

About the job

Make security the reason people trust Ockto

Own security at the platform people use to share their most personal data

Every day, people use Ockto to share their identity, income, assets and bank data: when they apply for a mortgage, rent a home or take out a lease. Banks and other large organisations choose Ockto partly because of the level of assurance we offer around that data. At Ockto, security is not a support function. It is part of the product and organisational culture.

As our CISO, you make sure it stays that way as we grow. Part of that growth is adopting an AI driven operating model with strong guardrails. You own Ockto's security programme, from risk and controls to incidents, suppliers and audits. You set the standard, check that it is met, and make security measurable in a way that the whole organisation (and specifically our engineers and spec leads), clients, auditors and regulators all recognise. You do this with a real mandate and short lines to the people who decide.

What you'll do

You own the information security programme of a supervised financial company and make it work in daily practice, not just on paper. As CISO, you:

• Own Ockto's ISMS and security policy framework, and keep our ISO 27001 certification (held since 2017) and our SOC 2 assurance current and credible.
• Translate the risk appetite set by management into a security strategy, an annual plan and clear standards that teams can build to.
• Keep Ockto ahead of what's coming. You track developments such as eIDAS2 and the EU Digital Identity Wallet, NIS2, the Cyber Resilience Act and the AI Act, assess what they mean for Ockto and our clients, and translate them into our security strategy and standards in time.
• Verify and challenge. Our engineering teams operate the technical controls; you check that they work and that findings get fixed. You approve risk acceptance for serious vulnerabilities and commission penetration tests. All control owners are challenged and prepared to show evidence and reproduce controls.
• Lead the response to security and privacy incidents, approve notifications to regulators, and make sure root causes lead to structural fixes.
• Manage security risk in our supply chain, from onboarding new suppliers to the annual review of critical ones, in line with DORA.
• Make sure our continuity and recovery arrangements are tested and hold up, together with Engineering.
• Make security measurable. We judge it by how quickly and how structurally we resolve what we find, not by counting incidents.
• Represent Ockto's security towards clients, auditors and supervisors: from a bank's due diligence questionnaire to our external audits and contact with DNB and AFM.
• Build a security-aware culture with an awareness programme people actually remember.

Who you work with

You report to our Product & Trust Director, who sets Ockto's trust framework and risk appetite. Within that framework, the security strategy and its execution are yours. On security matters you also have a direct line to our CEO, and you are involved early in the product and architecture decisions that shape our risk. Our Information Security Officer is part of your team and runs day-to-day control monitoring with you.

You also work closely with our Engineering Director and the value stream teams that build and run the Ockto platform. They operate the technical controls as the first line; you set the requirements, verify and challenge as the second.

Outside Ockto, you work with the security, risk and procurement teams of our clients and with our external auditors. For audits you are the first line of planning, execution and communication with the auditor(s). Together with the Product & Trust Director, you are Ockto's security contact for DNB and AFM.

What you bring

You combine depth in security with the judgement to apply it pragmatically in a scale-up. We're looking for someone who:

• Has 8+ years of experience in information security, including at least 3 years leading a security function as CISO, Head of Security or similar.

• Has run an ISMS end to end and taken an organisation through ISO 27001 and SOC 2 Type II audits.

• Knows regulated financial services and works comfortably with DORA, PSD2, GDPR and supervision by DNB or AFM.

• Has solid grounding in cloud security, preferably AWS, and enough technical understanding to challenge engineers and judge designs.

• Thinks in risk: turns threats into priorities, and weighs security against cost and delivery speed.

• Communicates clearly at every level, from the management team and auditors to developers and a client's security officer.

• Is independent and principled: comfortable saying no, and good at finding the route to yes.

• Speaks and writes English fluently; Dutch is a strong advantage.

Will be a plus:

• CISSP, CISM, CCSP or ISO 27001 Lead Auditor or Lead Implementer certification.

• Experience with privacy governance and DPIAs.

• Experience leading incident response, including notification to regulators.

• Experience with third-party risk management and assurance reporting such as ISAE 3402 or ISAE 3000.

• Familiarity with digital identity, eIDAS2 and EU digital identity wallets.

• Experience governing the safe use of AI tooling in a data-sensitive environment.

What you get

You get a role with real influence on how far clients, supervisors and consumers can trust Ockto.

• Ownership of security at a company where assurance is one of the reasons clients choose us.

• A real mandate: a direct line to the CEO on security matters, a voice early in product and architecture decisions, and the final word on accepting serious security risk.

• Influence on what we build next, as Ockto grows into new markets and propositions.

• Short lines and room to shape the security function the way it should work.

• Experienced colleagues across product, engineering and compliance.

Ockto also offers:

• A good salary: between €5500,- and €6800,- per month, depending on experience

• Room and budget for personal and professional development

• A MacBook Pro and smartphone of choice

• Phone and travel allowance

• Great home and remote working facilities

• Lunch fee

• Plenty of activities, including our annual ski trip, a 1.5-day team offsite, drinks and team outings

You'll join a team that values diversity and collaboration, in a friendly, ambitious and innovative atmosphere.

About Ockto

Ockto is the leading platform for future-proof wallet services. For more than ten years we have been taking the friction out of sharing, verifying and enriching personal data, so that organisations and people can trust each other faster, based on the right information. From our office in Naarden, a team of specialists builds data-driven customer journeys that are right the first time.

Ockto. Built for trust.

Ready to join?

Do you see yourself as our new CISO? Then apply directly. After you apply, we'll contact you within five working days to discuss the role and answer your questions.

Want to know more first? Contact us at hr@ockto.nl. Curious about our company culture, core values and recruitment process, or our other vacancies? Take a look at ockto.recruitee.com.

Your data is safe

At Ockto, we only use your CV and motivation letter during the application process to assess your application. If we don't proceed, we keep your application data for four weeks.