Head of Information Security, DUCO
Office located in Barbican, London
Data integrity and reconciliation services
Open for applications
Data integrity and reconciliation services
101-200 employees
Open for applications
Office located in Barbican, London
101-200 employees
Company mission
Duco's mission is to make managing data easy.
Role
Who you are
- Proven track record of strategic impact at company-wide and industry-wide
- Recognised internally and externally as an InfoSec expert, with evidence of
- Exceptional technical and people leadership
- Establishes long-term security architecture aligned to business strategy and
- Regulatory requirements; guides enterprise technology decisions including
- Cloud strategy and zero trust
- Anticipates emerging threats, leverages AI/ML for predictive security, and
- Sets the technology vision
- Deep understanding of the GRC landscape; implements appropriate controls
- And adapts as the environment shifts
- Develops proven solutions and replicates them across teams; designs
- Systems and frameworks built to last
- Accountable and collaborative: works with clients and colleagues to resolve
- Complex issues and views challenges as opportunities to improve
- Owns execution of security, GRC, and IT Ops strategy; ensures frameworks
- Are scalable, adaptable, and aligned to business strategy and executive-level
- Risk expectations
- Market knowledge
- Deep understanding of the security and risk landscape across fintech and beyond; adapts market knowledge to continuously improve Duco's posture
- Evaluates and integrates advanced security technologies and GRC best practices; knows when to buy, adapt, or build internally
- Acts as a recognised industry leader: participates in regulatory advisory groups, defines Duco's position on InfoSec maturity, and anticipates regulatory shifts before they arrive
- Scope and influence
- Operates across all departments; builds sponsorship for strategic initiatives
- And drives them through
- Leads all InfoSec, GRC, and IT Ops functions with cross-functional influence
- Across product, engineering, and compliance
- Recognised outside of Duco for technology excellence; participates in
- Industry events and shapes the wider conversation on risk and threat
- Influences executive peers, board decisions, and global regulatory
- Compliance strategy
- 8+ years of progressive experience in information security, with at least 3 years in a senior or leadership role
- Hands-on experience owning ISO 27001 and SOC 1 and SOC 2 programmes, not just supporting them
- Demonstrated experience managing security incidents end-to-end, including client and regulatory communications
- Strong understanding of cloud security, particularly AWS, including IAM, logging, and observability infrastructure
- Experience operating in a B2B SaaS or fintech environment, with exposure to enterprise client security requirements
- Track record of building and managing TPRM programmes at scale
- Excellent stakeholder management skills; comfortable presenting to the board and to client security teams in equal measure
- Ability to make pragmatic decisions based on company culture and risk appetite
- Strong written communication skills: able to translate complex security topics into clear, plain-language communications for non-technical audiences
- Experience leading and developing a small, high-performing team
- Familiarity with AI governance and the security implications of agentic AI systems
What the job involves
- We are looking for a Head of Information Security to own our end-to-end security posture, govern our risk and compliance programme, and lead our IT Operations function. This is a VP Level role with company-wide scope
- With approximately 200 employees across London, New York, Wroclaw, Antwerp, and Singapore, we move fast, build with purpose, and hold ourselves to a high bar. As we scale, information security, governance, and IT operations sit at the heart of that ambition
- Define security architecture standards and lead threat modelling across the organisation
- Establish and maintain long-term security architecture aligned to business strategy and regulatory requirements
- Guide technology decisions at an enterprise level, including cloud strategy and zero trust adoption
- Oversee penetration testing, DLP, and advanced threat detection programmes
- Own the vulnerability management programme
- Implement enterprise frameworks including IAM, SIEM, and data classification
- Anticipate emerging threats, leverage AI/ML for predictive security, and set the technology vision
- Lead Security Incident Response Programme
- Define and own the GRC programme, including the ISMS, policy framework, risk registers, and audit readiness
- Implement and maintain compliance with ISO 27001, SOC 1, SOC 2, NIST CSF, GDPR, and relevant financial services regulations
- Understand the GRC landscape, implement appropriate controls, and adapt as the threat and regulatory environment shifts
- Own execution of GRC strategy across the organisation; ensure frameworks are scalable and adaptable
- Own Third Party Risk Management (TRPM) programme, including vendor assessments and ongoing oversight
- IT operations
- Define and own the IT Operations programme, setting strategy and standards for the function
- Own execution of IT Operations strategy; ensure frameworks are scalable and adaptable as Duco grows
- Ensure operational excellence across infrastructure, tooling, and end-user support
- Leadership and stakeholder management
- Lead, mentor, and develop a high-performing team across InfoSec, GRC, and IT Ops
- Build strategic relationships with clients, regulators, and internal stakeholders
- Engage effectively with large, complex, and multi-national enterprise clients
- That have mission-critical operations requirements, building trust and
- Credibility at the most senior levels
- Recognise, influence, and resolve critical issues that may affect company direction
- Create strategies that cross organisational boundaries to achieve broad business goals
- Work with industry peers and working groups to develop solutions that benefit the wider market
- Enterprise Client Assurance: Act as a key partner to Duco's Client Success and Pre-Sales teams. This involves speaking directly with the CISOs and security teams of global financial institutions to assure them of Duco’s risk management and data privacy practices
Salary benchmarks
Our take
Enterprises capture and generate a vast amount of business-critical data, but inconsistencies in formating and difficulty in reporting across multiple data silos can make it extremely difficult to actually use this data for operational decision making. Duco exists to solve this problem with a no-code platform to reduce the complexity of a company's data stack, processing, reconciling and drawing insights from data without requiring any special expertise.
Duco's no-code approach, using natural language processing to manage queries, means that decision makers can directly poll data without relying on technical teams or external firms. This leads to cost savings, which have generated a return on investment for Duco's customers in less than a year. So far, Duco's services have been taken up by major firms such as HSBC, Lloyds Bank and Santander, to name just a few.
The company has expanded into Asia and is using investment to further refine the product, allowing it to solve more complex data problems for its clients. As more and more companies realise that there is an easier alternative to reconciling their data than doing it by hand, Duco, having refreshed its leadership in 2026, is in an excellent position to continue its rapid growth.
Steph
Company Specialist at Welcome to the Jungle
Insights
15% employee growth in 12 months
Company
Funding (1 round)
Jan 2018
$28m
SERIES B
Total funding: $28m
Company benefits
- Unlimited Holiday
- Success Share Bonus Payments
- Private Medical Insurance
- 4X salary life assurance
- Spot Rewards
- Enhanced Family Leave
- Pressure-off Fridays
- Milestone moments
- Health Cash Plan
- Home Working Allowance
- Employee Assistance Programme (EAP)
- Cycle to Work and Tech Scheme
- Electric Car Leasing Scheme
Company HQ
Farringdon, London, UK
Leadership
Christian Nentwich
(Founder & CEO)Prior to Duco, Christian founded Systemwire, which exited to Message Automation and further to Broadridge. Holds a BSc and PhD in Computer Science from University College London.
Michael Chin
(Senior Advisor)Also a Member of the Board of Directors at IPC Systems and EC1 Partners. Previously CEO at Duco, Head of Broadway Technology at Bloomberg and was a Managing Director at Refinitiv.
Share this job
View 2 more jobs at DUCO