Head of Security, IT & AI Governance

Obligo is looking for a Head of Security, IT & AI Governance to own security and IT end to end. You will set the strategy, lead the team, and also roll up your sleeves to deploy, configure and investigate yourself. You will secure a fintech that handles open-banking and sensitive financial data, and an AI-powered product and workforce, from day one.

What you will do

• Own security and IT strategy. Define and execute the multi-year security and IT roadmap, budget and scorecards, and communicate risk clearly to leadership, customers and auditors.
• Secure our AI footprint. Improve our AI security and governance program covering AI tools used by employees (approved-tool lists, shadow-AI discovery, data-leakage controls) and AI built into our product (prompt injection, sensitive-data disclosure, excessive agency of AI agents, MCP/tool and model supply-chain risk, vector/RAG data exposure). Align with OWASP LLM Top 10, NIST AI RMF and ISO 42001.
• Strengthen security monitoring and Zero Trust controls. Continuously improve detection, response and access security across AWS, Google Workspace, endpoints and SaaS. Work hands-on with SIEM and SASE / Zero Trust technologies to refine logging, detection rules, alert triage and incident response, and strengthen access and data protection through SSO/MFA, device posture, ZTNA, SWG, CASB and DLP.
• Lead SOC 2 and compliance. Own SOC 2 readiness, audits and continuous monitoring (using Drata). Be the face of security in customer due diligence and questionnaires.
• Run cloud and application security. Harden AWS and Google Workspace, manage vulnerability management, annual penetration tests, secure code review, secrets and IAM hygiene, and work with R&D to embed security in the SDLC.
• Run IT operations. Own employee onboarding/offboarding, device management and hardening, software procurement, and the IT ticketing function with clear SLAs.
• Manage vendor and third-party risk. Run security reviews of vendors and third parties, including AI vendors, and keep the vendor inventory current.
• Improve security awareness. Run an ongoing security awareness program for all employees, including phishing simulations and training.
• Be hands-on. Investigate alerts, write detections and automation, configure tooling and respond to incidents yourself, while leading and growing the team (today a SecOps engineer, and external IT company) and managing vendors.
• Co-lead risk. Serve as the primary technology-risk voice on the Obligo Risk Committee, working closely with R&D, Legal and Operations leadership.
  
  

• 5+ years in security and IT, including 2+ years in a leadership role at a cloud-native, fast-growing company (fintech or SaaS an advantage).
• Proven, hands-on experience working and implementing tools such as a SIEM (e.g. Splunk, Sentinel, Elastic, Wazuh, Panther, Sumo Logic) and a SASE or modern Zero Trust stack, including ZTNA/SWG (e.g. Zscaler, Netskope, Cloudflare, Palo Alto Prisma).
• Deep, current knowledge of AI security risks and controls, for both employee use of AI and AI-powered products, including agentic AI and LLM-specific threats.
• Direct experience leading SOC 2 (Type II) readiness and audits end to end, ideally with a compliance automation platform. ISO 27001, PCI or similar is a plus.
• Strong AWS and Google Workspace security background: IAM, network, logging, endpoint management (MDM/EDR) and SSO/MFA.
• Real management skills: Led technical people, and you are equally comfortable running the keyboard yourself.
• Excellent communication in English; able to translate risk into business language for executives, auditors and customers.
• Calm under pressure, structured, ownership-driven, and comfortable with ambiguity in a startup environment.
  
  

• Real ownership, with the mandate and budget to build the program properly.
• Greenfield work on modern problems: SIEM, SASE/Zero Trust and AI security, instead of maintaining legacy systems.
• A collaborative, high-energy team in our Tel Aviv office.