Security Lead

About the role

This is not a gatekeeper role. This is an enabler role. Your job is to find the secure way to say yes.

You’ll be the first person fully dedicated to security at Roundtable. That means the scope is intentionally broad: from a developer opening a PR, to the configuration of our Google Workspace, to what’s running on an employee’s laptop, all the way to ISO 27001 and DORA.

You won’t own all the implementation yourself. You’ll work closely with Platform, Engineering, Legal and Operations or external partners. But when it comes to security, you’ll be the person making sure nothing falls between the cracks.

What you’ll work on

Corporate & IT Security

• Own the security posture of our internal environment: laptops, MDM, Google Workspace, email, browsers, SaaS tools, privileged accounts and authentication.

• Keep our shadow IT under control, regularly review access and permissions, and make sure every critical tool has the right owners and administrators.

• Think about what happens when an employee account or laptop gets compromised, and continuously reduce the blast radius.

Product & Infrastructure Security

Work closely with our Engineering and Platform teams to make security part of how we build and operate Roundtable.

• Review sensitive PRs and architecture decisions

• Identify configuration gaps

• Improve IAM and secrets management

• Contribute to secure IaC patterns

• Keep an eye on dependencies, containers and our software supply chain

Security Operations & Resilience

Make sure our security controls don’t just exist on paper.

Own recurring security operations: pentests, vulnerability remediation, access reviews, restore tests, incident exercises, patching follow-ups and security monitoring.

If we say our database can be restored, you’ll make sure we’ve actually tried restoring it.

Risk, Compliance & Certifications

• Own the technical reality behind our ISO 27001, DORA and GDPR commitments.

• You’ll work with Probo and our Legal team, who already help us with the documentation and compliance framework. Your role is to make sure what we document reflects what actually happens.

• Maintain our risk register, coordinate recurring controls, collect evidence and make sure we are always ready for the next audit.

People Security

Security is also about how 70 people use technology every day.

• Own our security awareness program, phishing exercises and security onboarding.

• Help both technical and non-technical teams understand threats without turning security into bureaucracy.

• Build guardrails where possible instead of relying on people remembering rules.

Offensive Security & Exposure

Continuously ask: how would someone attack us?

• Maintain an inventory of what we expose to the Internet.

• Use OSINT, automated scanners, security tooling and AI against our own systems.

• Coordinate pentests and make sure their findings actually result in improvements.

Think through our worst-case scenarios:

• Data exfiltration

• Ransomware

• Account takeover

• Platform unavailability

Then work backwards.

Vendors & Customers

• Review the security posture of the services we depend on and understand what access they have to our systems and data.

• Help answer enterprise security questionnaires and be able to explain our architecture, controls and security posture to institutional clients.

Build Things

This is a hands-on role.

• Automate repetitive controls.

• Build internal security tooling.

• Write scripts.

• Open PRs.

• Improve our IaC.

• Connect APIs.

• Experiment with new security tools.

And when you find something interesting outside the strict security perimeter, from OSINT to internal tooling or competitive intelligence, explore it.

We don’t want someone spending their week updating spreadsheets.

We want someone who understands our attack surface, continuously makes it smaller, and can demonstrate that our security controls actually work.

You're a great match ifTechnical skills:6+ years in security, with hands-on work across corporate IT, cloud infrastructure and product security.You’ve been through ISO 27001, DORA or GDPR work from the technical side, and you know what an auditor checks.You know cloud environments well enough to review IAM, secrets management and IaC. GCP is