Security Architect

We are looking for our first dedicated Security Architect to own Information Security across Biller Genie. Today, security responsibilities are spread across IT and Engineering and handled largely as needed. You will bring that work together under a single, accountable function: setting the strategy, building the governance framework, and partnering with IT and Engineering to raise our security maturity across our production platform, corporate environment, endpoints, and product development lifecycle.

This is a hands‑on leadership role. You will write policy and present to the executive team, but you will also design controls, tune detection tooling, and sit with engineers to review architecture.

• Establish and own the Information Security governance framework, including policies, standards, and procedures, and secure executive approval for them.
• Develop and maintain a leadership‑approved Information Security risk management strategy and risk register.
• Implement security incident management procedures covering reporting, classification, response, record‑keeping, and post‑incident review.
• Deliver regular reporting to senior leadership on security posture, incidents, risks, and program progress.
• Implement third‑party and vendor risk management procedures, including security assessment, approval, and ongoing assurance.
• Own Business Continuity and Disaster Recovery planning and run regular exercises to validate them.
• Maintain a threat intelligence process that tracks advisories from government and industry bodies and turns them into action.
• Define regulatory, contractual, and breach‑notification obligations, and keep security controls aligned with compliance frameworks (e.g. PCI DSS, SOC
  2) and cyber insurance requirements.
• Own the Information Security budget and make resourcing and tooling recommendations.

• Define and maintain security architecture standards for our cloud production environments, in partnership with Engineering.
• Implement Cloud Security Posture Management practices and policy.
• Establish vulnerability and patch management procedures, including software supply‑chain and dependency management, with defined remediation SLAs.
• Design production monitoring, logging, and threat detection capabilities.
• Develop production incident response, compromise recovery, and ransomware response plans, and run regular tabletop exercises against them.
• Define production backup, recovery, and resilience standards, including recovery time and recovery point objectives.
• Oversee the security testing program, including vulnerability scanning, penetration testing, and its evolution against emerging threats.
• Govern production identity, access, and secrets management standards.

• Define and implement identity and access management standards, including privileged access governance and periodic access reviews.
• Establish credential and secrets governance procedures, including the full joiner‑mover‑leaver lifecycle.
• Implement data classification, handling, retention, and destruction policies across the organization.
• Define corporate backup, recovery, and compromise response procedures.
• Establish centralized security logging, monitoring, and alerting (SIEM) capabilities, with clear ownership.
• Implement corporate vulnerability management and security testing practices.
• Govern the secure use of AI tools and AI‑integrated systems across the business.

• Own the endpoint security strategy and the configuration, tuning, and effectiveness review of endpoint protection…