Chief Information Security Officer

Company Description RedShield is a security partner focused on protecting businesses from application-related risks through an expert-driven, AWS-powered service. The company delivers app-specific threat protection and rapid fixes without requiring changes to underlying code, helping teams secure systems efficiently. RedShield helps organizations reduce risk, control security costs, and enable development teams to concentrate on innovation and growth.Role Description The Chief Information Security Officer is a senior executive leadership role responsible for establishing and leading RedShield's dedicated Security pillar. This role owns the organisation's cyber security posture, security research capability, threat intelligence function, technology risk management framework, and internal audit programme.Reporting directly to the Chief Executive Officer and forming part of the Executive Team, the role holder will build, lead and develop a high-performing security team while ensuring RedShield's internal security practices are exemplary, mature, and aligned with both customer commitments and regulatory obligations.The role requires a hands-on leader who can balance strategic security leadership with operational delivery across controls testing and assurance, vulnerability research, risk assessment, compliance, and audit. Working closely with the Chief Technology Officer on matters of architectural alignment and the Chief of Staff on corporate governance and risk reporting, this role will be instrumental in shaping RedShield's security-led culture and ensuring the organisation operates from a position of strength.Cyber Security & Information Security Management

• Establish, own, and continuously improve RedShield's Information Security Management System (ISMS), ensuring alignment with ISO 27001, SOC 2, and applicable regulatory frameworks.
• Develop, implement, and maintain security policies, standards, and procedures across the organisation, ensuring they are embedded in day-to-day operations and understood by all staff.
• Lead RedShield's security incident response programme, including the development of incident response plans, tabletop exercises, and post-incident reviews to drive continuous improvement.
• Oversee and manage RedShield's internal security posture — including vulnerability management, patch management, and security hardening across systems, applications, and cloud infrastructure.
• Drive a culture of security awareness throughout the organisation, designing and delivering training and awareness programmes that equip staff to identify and respond to threats.Security Research & Threat Intelligence
• Rebuild and lead RedShield's security research capability, establishing a programme of proactive vulnerability research and CVE discovery that reinforces RedShield's reputation as an expert authority in applicationsecurity.
• Develop and maintain a threat intelligence programme that monitors the evolving threat landscape, translating intelligence into actionable risk insights for the business and its customers.
• Oversee the development and publication of security research, threat advisories, and vulnerability disclosures in accordance with responsible disclosure standards.
• Ensure security research capabilities are aligned to RedShield's product and service strategy, contributing to the development of new and enhanced service offerings.
• Foster relationships with the broader security research community, academic institutions, and government bodies to ensure RedShield remains at the forefront of emerging threat knowledge.Testing & Assurance
• Oversee the delivery of vulnerability assessment capabilities, including testing of controls, ensuring methodologies, standards, and reporting meet the highest professional benchmarks.
• Ensure rigorous quality assurance processes are applied to all testing and assurance outputs, maintaining RedShield's standard of excellence and customer trust.
• Lead the development and continuous improvement of testing methodologies, tools, and frameworks, including red team and purple team exercises where appropriate.
• Work with the Customer and Technology pillars to embed security assurance into the delivery lifecycle, ensuring testing insights contribute to customer security improvement programmes.Technology Risk & Compliance
• Develop and maintain a comprehensive technology risk framework and risk register, ensuring all material risks are identified, assessed, and managed in line with RedShield's risk appetite.
• Lead RedShield's compliance programme, ensuring ongoing adherence to relevant regulatory requirements, industry standards, and contractual obligations across all jurisdictions in which RedShield operates (NewZealand, Australia, United States).
• Manage third-party and supply chain risk assessments, ensuring that vendors and partners meet RedShield's security and compliance requirements.
• Provide regular risk and compliance reporting to the CEO and Board, delivering clear, concise insights that enable informed decision-making at the executive and governance level.
• Monitor the regulatory environment for changes that may impact RedShield's compliance obligations, proactively developing plans to address emerging requirements.Government Assurance & Certification
• Own RedShield’s continuous NZISM certification and accreditation programme for services delivered to NewZealand Government agencies, based on ongoing security risk management.
• Own IRAP (Infosec Registered Assessors Program) assessment planning, evidence preparation, remediation tracking and assessor engagement to maintain and renew RedShield’s IRAP-assessed posture.
• Ensure compliance with the Australian Government Information Security Manual (AU ISM) and alignment with the Protective Security Policy Framework (PSPF) for Australian Government agency services.Internal Audit
• Develop, manage, and execute RedShield's internal audit programme, providing independent assurance over the effectiveness of internal controls, risk management processes, and governance frameworks.
• Report audit findings clearly and objectively, working constructively with business owners to agree remediation actions and track delivery to resolution.
• Act as RedShield's primary liaison for external audit processes, regulatory examinations, and certifications, coordinating evidence gathering and response activities across the organisation.
• Ensure audit findings and control gaps are remediated in a timely and effective manner, escalating material issues to the CEO and Board as appropriate.Team Leadership & Development
• Build, lead, and develop the Security pillar team — initially comprising the InfoSec Manager, we have identified key roles across security research, penetration / controls testing and security engineering we need to recruit with an expectation that the team will grow as RedShield scales.
• Recruit and onboard new Security team members with a focus on technical excellence, cultural fit, and alignment to RedShield's mission.
• Foster a high-performance, collaborative team culture that balances rigour and discipline with innovation and continuous learning.
• Ensure all Security team members have clear goals, regular feedback, and meaningful developmentopportunities aligned to their career aspirations and RedShield's strategic needs.
• Ensure all work is tracked, prioritised, and delivered in an organised manner through appropriate sprintplanning, work allocation, and project management practices.
• Collaborate closely with the Chief Technology Officer to ensure alignment between the Security pillar and theTechnology pillar, particularly on matters of infrastructure security, cloud architecture, and securityengineering.Customer Trust & Commercial Enablement
• Act as RedShield’s senior security authority in strategic customer engagements, executive briefings and Quarterly Business Reviews, articulating RedShield’s security posture and value.
• Own customer-facing security assurance collateral — trust packs, certifications, and responses to customer security questionnaires and due-diligence requests.
• Support the Customer and Commercial pillars on security aspects of RFPs, contracts and pre-sales engagements, translating RedShield’s internal security maturity into a demonstrable commercial differentiator.
• Use RedShield’s own ‘beyond reproach’ security posture as a proof point that reinforces customer trust and supports revenue growth.Qualifications & Experience
• 5+ years of experience in senior cyber security roles, including demonstrable experience leading security functions within technology businesses or managed security service providers.
• Proven experience in controls testing and assurance, vulnerability assessment, or offensive security, with the ability to lead and quality-assure technical testing programmes.
• Demonstrated experience designing and implementing an ISMS aligned to ISO 27001 and/or SOC 2, including policy development, control implementation, and certification management.
• Strong background in technology risk management, including risk framework development, risk register management, and risk reporting to executive and board-level stakeholders.
• Demonstrated leadership of technical security teams, including recruitment, performance management, and professional development of security professionals.Key Competencies
• Strategic Security Leadership: Demonstrated ability to develop and execute a forward-looking security strategy that is aligned to business objectives, builds organisational resilience, and positions RedShield as atrusted security authority.
• Technical Depth: Deep technical expertise across cyber security domains including controls testing, vulnerability research, cloud security, identity and access management, and application security — with the credibility to lead highly skilled technical teams.