Compliance Program Manager - Dora

Netherlands, London·Posted 2mo ago

cryptoblockchainweb3fintechpythongokubernetesaws

About Us OpenFX is on a mission to move money as freely as data, unrestricted by time zones, banking hours, or legacy systems. We are building the infrastructure that will power the next generation of cross-border payment systems for institutions. The team's execution has been exceptional, and we're scaling at a remarkable pace. Our stellar early team comes with experience in companies like J.P. Morgan, Goldman Sachs, FalconX, Paypal, Affirm, Polygon, Kraken, Nium & others. We're backed by Accel, Lightspeed, NfX and other top-tier investors. Role Overview We are looking for a Security & Compliance Engineer to turn regulatory requirements into real, running controls — and then prove to auditors that they work. This is a senior, hands-on role for someone who thrives in fast-paced, heavily regulated environments and knows how to make compliance provable in production rather than on paper. OpenFX is expanding across Europe in a heavily regulated financial environment. As we scale into EU markets, regulators, auditors, and enterprise partners expect provable, continuously operating security controls — not slide decks or one-off audits. Compliance requirements (DORA, GDPR, SOC 2, ISO 27001, and region-specific regulations) are increasing faster than our ability to operationalize them, and this role exists to close that gap. You will own the security controls and evidence that regulators and auditors care about, end to end — from translating regulatory language into concrete mechanisms through to audit walkthroughs and remediation. You will partner closely with Legal, Compliance, Risk, and engineering to ensure compliance is built into the platform rather than bolted on after the fact. This role is based in Amsterdam, Netherlands (EU/EEA). Key Responsibilities: <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="21:1-37:92;1880-3270"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="21:1-23:111;1880-2169">Own audit-ready security controls <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="22:3-23:111;1922-2169"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="22:3-22:139;1922-2058">Design, implement, and maintain technical and operational controls for DORA, GDPR, SOC 2, ISO 27001, and future regional requirements.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="23:3-23:111;2061-2169">Ensure controls are not just documented, but actually enforced in AWS, Kubernetes, and application layers.</li> </ul> </li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="24:1-27:69;2170-2464">Be the technical counterpart to Legal, Compliance & Risk <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="25:3-27:69;2235-2464"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="25:3-25:69;2235-2301">Translate regulatory language into concrete security mechanisms.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="26:3-26:94;2304-2395">Partner with Legal and Compliance to monitor new regulations and assess technical impact.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="27:3-27:69;2398-2464">Decide what is "good enough" vs. over-engineered for compliance.</li> </ul> </li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="28:1-31:83;2465-2765">Run audits instead of reacting to them <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="29:3-31:83;2512-2765"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="29:3-29:88;2512-2597">Own audit preparation, evidence collection, walkthroughs, and remediation tracking.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="30:3-30:85;2600-2682">Build repeatable, automated evidence pipelines instead of last-minute scrambles.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="31:3-31:83;2685-2765">Be the person auditors trust when they ask, "Show me how this actually works."</li> </ul> </li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="32:1-34:113;2766-3020">Embed compliance into the platform <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="33:3-34:113;2809-3020"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="33:3-33:101;2809-2907">Work with engineering to design systems that are secure by default and defensible to regulators.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="34:3-34:113;2910-3020">Ensure logging, access controls, encryption, monitoring, and change management meet regulatory expectations.</li> </ul> </li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="35:1-37:92;3021-3270">Automate compliance wherever possible <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="36:3-37:92;3067-3270"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="36:3-36:114;3067-3178">Build tooling and scripts to continuously validate controls (access reviews, logging coverage, config drift).</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="37:3-37:92;3181-3270">Reduce manual compliance work over time by pushing checks into code and infrastructure.</li> </ul> </li> </ul> What we are looking for Must-haves: <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="43:1-50:91;3318-4207"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="43:1-43:90;3318-3407">6+ years in security engineering, cloud security, or compliance-focused security roles.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="44:1-44:306;3408-3713">Hands-on, operational experience implementing DORA in a production/regulated environment (not advisory only) — e.g. ICT risk management, incident classification and reporting, third-party/ICT vendor oversight, and digital operational resilience testing. GDPR implementation experience is a strong bonus.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="45:1-45:69;3714-3782">Experience supporting SOC 2 and/or ISO 27001 audits (strong plus).</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="46:1-46:72;3783-3854">Ability to translate regulatory requirements into technical controls.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="47:1-47:96;3855-3950">Strong working knowledge of AWS security fundamentals (IAM, logging, encryption, networking).</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="48:1-48:74;3951-4024">Comfortable owning auditor interactions and explaining systems clearly.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="49:1-49:92;4025-4116">Experience building or automating security/compliance processes (Python, Bash, Go, etc.).</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="50:1-50:91;4117-4207">Accountability for an audit outcome — if you've never owned one, this role is not a fit.</li> </ul> What helps you stand out: <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="54:1-59:123;4240-4708"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="54:1-54:47;4240-4286">Experience securing Kubernetes environments.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="55:1-55:63;4287-4349">Familiarity with AppSec tooling (SAST/DAST, manual testing).</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="56:1-56:75;4350-4424">Experience with AWS security services (GuardDuty, Config, Security Hub).</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="57:1-57:64;4425-4488">Prior work in fintech, payments, or regulated infrastructure.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="58:1-58:97;4489-4585">Security or compliance certifications (CISSP, CISA, ISO 27001 Lead Implementer, AWS Security).</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="59:1-59:123;4586-4708">Familiarity with EU financial regulators and national competent authorities (e.g. DNB/AFM in the Netherlands, EBA/ESMA).</li> </ul> What We Offer <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="63:1-67:80;4729-5054"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="63:1-63:43;4729-4771">Competitive salary and benefits package.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="64:1-64:39;4772-4810">Equity in a rapidly growing company.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="65:1-65:86;4811-4896">Opportunity to work in a fast-paced startup at the forefront of fintech innovation.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="66:1-66:78;4897-4974">Opportunity to make a significant impact on global financial infrastructure</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="67:1-67:80;4975-5054">Collaborative work culture with emphasis on personal and professional growth.</li> </ul> We are committed to building a diverse and inclusive workplace. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.

Apply for this role