About the role

ContactVerse holds other people's customer conversations and runs AI agents that act on them. That makes security a condition of sale as much as an engineering concern: every enterprise deal will arrive with a questionnaire, and every AI agent raises the question of what it may do and under whose identity. This role owns security, trust and the evidence customers ask for. It reports to the Chief Executive rather than to technology, deliberately, so that it can say no to the function it polices.

What you will do

• Own the security of the platform. And of the customer data in it, across AWS, the application estate and the supply chain.
• Own certification and audit. The path to SOC 2, ISO 27001 or whatever the market demands, and the questionnaire that arrives with every enterprise deal.
• Own access governance. Human and non-human. Automation and AI agents act under scoped, least-privilege identities, never a person's credentials, and never the founder's.
• Own incident response. Including the authority to stop a release, which is why this role reports to the CEO.
• Own the agent boundary with the CTO/CAIO. What an agent may do unsupervised, on which surface, and what must be approved by a human first.
• Own vendor and model-provider risk. What our providers may do with our customers' data, and what we have agreed to.
• Own secrets management. Credentials in AWS Secrets Manager, rotation, and the inventory that makes a clean revocation possible when someone leaves.
• Build security into delivery. Branch protection, review requirements, dependency and secret scanning, rather than a review at the end.
• Be the trust face to customers. In diligence calls, in security reviews and when something goes wrong.

Your first year

First 90 days. A security posture written down, and the gaps ranked by what a customer would ask about first.

By six months. The certification path under way, and access governance covering automation as well as people.

By twelve months. A trust position that wins deals rather than delaying them.

What you will bring

• Twelve years or more in security, including a leadership role in a SaaS company that passed enterprise due diligence.
• Has taken a company through a certification (SOC 2, ISO 27001 or equivalent) from nothing.
• Deep AWS security experience: identity, network, secrets, logging.
• Has designed access governance covering automation and service identities, not only people.
• Has run a real incident, including the customer communication.
• Understands data protection obligations across the UK, EU and India well enough to work with counsel.
• Has stopped a release, and can explain how the relationship survived it.
• Pragmatic: able to secure a small company without the controls of a large one.

Nice to have

• Experience of securing AI or agentic systems specifically.
• Contact-centre, voice or messaging platforms, where the data is unusually sensitive.
• Experience with self-hosted CI runners and the risks they carry.
• Has built a security function from one person upward.
• Penetration testing or offensive security background.

What you will work with

AWS across several accounts by application and environment, GitHub with organisation-level rulesets and a self-hosted runner estate, Microsoft 365, AWS Secrets Manager, and an AI layer that routes through Core with provider credentials held centrally.

What this role is not

Not a compliance clerk. You will have the authority to stop a release, and you report to the CEO precisely so you can use it.

How we work

We are split between the UK and India, with most of the delivery organisation in India, four and a half hours ahead. Expect a working pattern with a genuine overlap into the late afternoon and early evening UK time. These hours are indicative and may change as the business changes. Everything is remote and nobody is in an office.

We are a small company and we write things down. Decisions are recorded, corrections are made to the source rather than to the output, and status is expected to be honest even when it is unwelcome.

Compensation and what we offer

• A long-term incentive, discussed at offer stage for senior appointments.
• Fully remote working, with company-provided equipment where the role requires it.
• A role with unusual scope for its level, because the organisation is being built rather than joined.
• Direct access to the founders. There are no layers between this role and the people making the decisions.

How we will assess you

We assess against three or four weighted signals agreed before we read a single CV, rather than against years of experience or a list of tools. Expect four stages:

• Introductory conversation with our People team. About 30 minutes, covering the role, your background and what you are looking for. This first conversation may be with an AI assistant; you will be told at the time and may ask to speak to a person instead.
• Conversation with the hiring manager. About 60 minutes, going deep on what you have done and how you think.
• A working session on a real ContactVerse problem. About 90 minutes. Not a whiteboard exercise and not a take-home test you do unpaid in your evenings.
• Final conversation with the founders. Covering fit, expectations and how we would work together.

We aim to complete the process within three weeks and to give you a decision, with reasons, within three working days of the final stage.

Equal opportunity

ContactVerse is an equal opportunity employer. We welcome applications regardless of age, disability, gender identity or expression, marital or civil partnership status, pregnancy or maternity, race, religion or belief, sex or sexual orientation. We select against the published signals for the role and nothing else. If you need an adjustment at any stage of the process, tell us and we will make it. It will not count against you.

Research consistently shows that some candidates apply only when they meet every criterion. If this role interests you and you meet most of what is listed, please apply.

How to apply

Write to career@contactverse.ai quoting reference POS-010, with your CV and a short note (a few paragraphs is plenty) on the part of this role you would most want to get your hands on, and why.