Head of Cyber Security

About Fat Zebra

At Fat Zebra, we simplify payments so merchants and platforms can scale with confidence. Our flexible, secure, and scalable payments platform supports merchants of all sizes across Australia. We help our customers navigate the complexities of the payments ecosystem—enabling them to focus on what matters most: growing their business.

About the Role

Fat Zebra is creating a dedicated Cyber Security function. As Head of Cyber Security, you will report directly to the Chief Technology Officer and lead a team of Cyber Security Engineers.

You will own cyber security across the business, including security engineering and PCI DSS compliance. You will set the strategy, build the team and give the business a clear view of security risk as we grow and as licensing and regulatory expectations increase. Any interim security cover provided by contractors will transition to your team.

Key Responsibilities include:

• Set and deliver Fat Zebra's cyber security strategy and roadmap, aligned to business risk and regulatory requirements.
• Own PCI DSS compliance and ASAE 3150 controls assurance end to end, including scoping, control design, evidence and the annual assessment..
• Recruit, lead and develop the two Cyber Security Engineers, and transition any interim contractor cover into the team.
• Own security engineering: secure cloud architecture, vulnerability management, security tooling and secure development practices with the engineering teams.
• Lead security incident response, including playbooks, exercises and coordination with Operations, SRE and executives during incidents.
• Maintain the security policy framework and a cyber risk register, and report security posture to the CTO, executive team and board.
• Manage third-party and vendor security risk, including due diligence for new suppliers and partners.
• Support audits, card scheme requirements, bank partner reviews and customer security questionnaires.
• Build security awareness across the business, including phishing and secure-practice training.
• Prepare the security function for payments licensing and other emerging regulatory obligations.
• Act as the senior escalation point for security incidents, including out-of-hours involvement when required

How you know you’ll succeed (KPIs)

• PCI DSS and ASAE 3150 compliance maintained, with quarterly and annual assessments completed on time and no overdue findings.
• A cyber security strategy and roadmap is approved within the first 90 days and delivered against agreed milestones.
• The Cyber Security team is hired and in place, with no reliance on interim contractors.
• Vulnerabilities are remediated within agreed timeframes.
• Security incidents are detected, contained and reported within agreed targets, and reviews are completed.
• Playbooks are developed for key Cyber breach risks and exercised at least annually.
• Security posture and risk are reported to the executive team and board on a regular cadence.
• Security awareness training completion and phishing-simulation results improve over time.

About You

• Significant experience in cyber security, including leading a security function or team.
• Experience building a security function or programme from scratch, including hiring.
• Deep, practical knowledge of PCI DSS, ideally in a payments, fintech or financial services business.
• Experience with frameworks such as ISO 27001, NIST CSF or the ASD Essential Eight.
• Experience securing cloud-hosted platforms (for example AWS) and working closely with engineering teams.
• A track record of leading security incident response and building practical, risk-based controls.
• The ability to explain security risk clearly to executives and the board, and to influence without slowing the business down.
• Relevant certifications (for example CISSP, CISM or PCI-related) are a plus.