Chief Information Security Officer (CISO)

Hawk is the leading provider of AI-supported anti-money laundering and fraud detection technology, serving banks and payment providers globally. Hawk builds AI-powered financial crime detection (AML, transaction monitoring, and fraud prevention) for global tier-1 banks, payment processors, and high-growth fintechs. We are looking for a technically grounded, hands-on CISO to own our global security posture end-to-end. This is a true player-coach leadership role, leading a dedicated team of four domain specialists while staying close to the technology.

Responsibilities

Lead, mentor, and set technical direction for four functional areas: Application Security, Corporate Security, Compliance & Governance, and Data Protection; Establish and enforce secure coding baselines and integrate automated vulnerability scanning, SBOM tracking, and security gates into GitHub/GitLab CI/CD pipelines; Protect build systems, dependencies, and deployment pipelines against supply chain tampering; Evaluate and implement protective mechanisms for AI tooling and workflows, including secure AI harnesses, container sandboxing, and runtime guardrails; Set remediation SLAs for CVEs and cloud misconfigurations and triage zero-days; Architect and drive the group-wide Zero Trust roadmap across AWS and GCP; Act as senior technical authority in enterprise sales cycles, engaging bank CISOs, InfoSec panels, and procurement leads; Modernize vendor due diligence with standardized evidence packages and continuous compliance portals; Act as executive owner of the company-wide Risk Registry; Oversee Third-Party Risk Management; Maintain ISO 27001 and SOC 2 Type II programs; Enforce end-to-end DORA compliance; Adapt policies to global financial standards across the EU, UK, US, Singapore, and upcoming markets; Translate cyber risks into business metrics for the CEO and Board; Serve as hands-on incident commander for Sev-1/Sev-2 security incidents; Direct regulator, law enforcement, and client breach communications within GDPR and DORA windows; Design and execute red team engagements, threat-led penetration tests (TLPT), and crisis simulations

Requirements

Proven background as a hands-on security practitioner (e.g., former security engineer, AppSec specialist, cloud security architect, or technical penetration tester) who has advanced into security leadership; Player-coach track record managing and growing a small team of domain experts while personally reviewing technical configurations, auditing cloud policies, or investigating alerts; Commercial and CISO-to-CISO fluency, with experience debating architecture, supply chain controls, and threat postures with enterprise bank CISOs and security evaluation boards; AI and supply chain defense fluency, including ability to understand AI architecture, implement hands-on controls for AI tooling (including AI harnesses and sandboxing), and protect CI/CD pipelines; Risk registry execution, including maintaining a living risk registry and articulating risk trade-offs to non-technical executives; FinTech or regulated SaaS background with multi-year leadership experience handling sensitive financial or transactional data under regulatory oversight (e.g., DORA, ISO 27001, SOC 2, GDPR); Technical breadth in AWS and GCP security primitives, container and Kubernetes security, modern IAM/SSO, API gateways, and EDR/XDR toolchains

Nice to have

Industry certifications reflecting technical or managerial competence (e.g., CISSP, CISM, CCSP, OSCP); Direct experience securing real-time event-streaming architectures; German language proficiency (conversational or fluent) is a strong advantage