Job Description

The Problem

OpenFX is expanding globally in a heavily regulated financial environment. As we scale into new regions, regulators, auditors, and enterprise partners expect provable, continuously operating security controls - not slide decks or one-off audits.

Right now, compliance requirements (DORA, GDPR, SOC 2, ISO 27001, and region-specific regulations) are increasing faster than our ability to operationalize them in production systems. If we don’t solve this, we risk:

• Slowing down market expansion
• Failing audits or regulatory exams
• Shipping security controls that look good on paper but don’t actually work

We need someone who can turn regulatory requirements into real, running controls - and then prove to auditors that they work.

This role has been created to support OpenFX as we continue expanding our institution-grade, regulator-facing infrastructure.

What You’ll Actually Do & Own (First 6–12 Months)

You will own the security controls and evidence that regulators and auditors care about, end to end.

Specifically, you will:

1. Own audit-ready security controls
   • Design, implement, and maintain technical and operational controls for SOC 2, ISO 27001, GDPR, DORA, and future regional requirements
   • Ensure controls are not just documented, but actually enforced in AWS, Kubernetes, and application layers
2. Be the technical counterpart to Legal, Compliance & Risk
   • Translate regulatory language into concrete security mechanisms
   • Partner with Legal/Compliance to monitor new regulations and assess technical impact
   • Decide what is “good enough” vs. over-engineered for compliance
3. Run audits instead of reacting to them
   • Own audit preparation, evidence collection, walkthroughs, and remediation tracking
   • Build repeatable, automated evidence pipelines instead of last-minute scrambles
   • Be the person auditors trust when they ask, “Show me how this actually works”
4. Embed compliance into the platform
   • Work with engineering to design systems that are secure by default and defensible to regulators
   • Ensure logging, access controls, encryption, monitoring, and change management meet regulatory expectations
5. Automate compliance wherever possible
   • Build tooling/scripts to continuously validate controls (access reviews, logging coverage, config drift, etc.)
   • Reduce manual compliance work over time by pushing checks into code and infrastructure

What Success Looks Like

You’ll know you’re succeeding if:

• SOC 2 / ISO 27001 audits complete with zero high-severity findings
• Establish control ownership, governance cadence, and compliance roadmap as the company scales
• GDPR and DORA compliance readiness, including regulator-facing engagement and response
• Regulatory requests are answered with evidence, not explanations
• New regional regulatory requirements are implemented without blocking launches
• Audit prep time decreases quarter-over-quarter due to automation
• Engineering teams ship features without creating compliance debt

If audits feel boring and predictable, you’re doing the job well.

Requirements

Required (Non-Negotiable)

• 6+ years in security engineering, cloud security, or compliance-focused security roles
• Hands-on experience supporting SOC 2, ISO 27001, GDPR, DORA, or similar regulatory frameworks
• Ability to translate regulatory requirements into technical controls
• Strong working knowledge of AWS security fundamentals (IAM, logging, encryption, networking)
• Comfortable owning auditor interactions and explaining systems clearly
• Experience building or automating security/compliance processes (Python, Bash, Go, etc.)

If you’ve never been accountable for an audit outcome, this role is not a fit.

Preferred (Nice to Have)

• Experience securing Kubernetes environments
• Familiarity with AppSec tooling (SAST/DAST, manual testing)
• Experience with AWS security services (GuardDuty, Config, Security Hub)
• Prior work in fintech, payments, or regulated infrastructure
• Security or compliance certifications (CISSP, CISA, ISO 27001 Lead Implementer, AWS Security)

Why This Role

This is not a checkbox compliance role.

In this role, you will:

• Shape how OpenFX proves trust to regulators, banks, and institutions
• Decide how security controls are implemented - not just documented
• See the immediate impact of your work on global expansion

You’ll learn how to build compliance that scales, not compliance that slows teams down - a skillset that’s rare and extremely valuable in fintech.

This Role Is Not For You If:

• You prefer compliance as primarily coordinating between teams rather than owning control execution end-to-end
• You approach audits by repeatedly pulling time and evidence from engineering instead of building scalable, audit-ready processes
• You are not comfortable driving documentation, evidence automation, and regulator-facing accountability
• You prefer compliance to remain a distributed responsibility rather than taking full ownership of outcomes