Security and Compliance Engineer

Glider; Philippines; Remote; PHP 2,000,000 - 3,500,000; Full time

Job summary

Glider, an Australian payments platform, seeks an experienced security leader to own the security assurance program and run AML/CTF compliance daily from a remote Philippines location. You will leverage AI-native workflows to scale assurance and work closely with Technology and executives.

The role demands hands-on security engineering, audits, policy governance and cross-functional collaboration to keep controls green and auditable across SOC 2, ISO 27001, and IRAP tracks.

Qualifications

• 4–6+ years in security engineering, GRC or security compliance in SaaS, fintech or regulated environments.
• Hands-on AWS security (IAM, logging, encryption, networking, Security Hub, GuardDuty).
• Experience administering an identity provider (Google Workspace, Okta, Entra ID) and MDM.
• Scripting in Python, Bash or PowerShell.
• Led SOC 2 Type 2 and ISO 27001 audits.
• Experience with Drata, Vanta or similar compliance tooling.
• Knowledge of Philippine Data Privacy Act and AU privacy principles.

Responsibilities

• Own security assurance program end to end and run AML/CTF compliance day to day.
• Fix issues across IAM, MFA, logging, encryption and platform configurations.
• Configure and maintain Drata integrations and the information security policy suite.
• Conduct AML/CTF risk assessments, merchant due diligence and audits.
• Prepare security materials for audits, customers and partners.
• Lead change management with Technology approvals and evidence collection.
• Rigorously review AI tool use for safety and compliance.

Skills

Security engineering

GRC

Security compliance

AWS security

KYC/AML controls

Scripting

Tools

AWS Security Hub

GuardDuty

Config

MDM

Job description

Reports to: CEO (AML/CTF Compliance Officer)

Works Closely With: Technology, Customer Success, Product, Fractional CFO, external auditors and assessors

Location: Remote (Philippines)

Glider is an Australian payments platform. We help enterprise billers collect faster using PayTo, real-time bank payments and smart payment journeys. Our customers include major billers, banks and federal government agencies, and they all expect strong security and compliance from us.

Glider is SOC 2 Type 2 certified, aligned to ISO 27001 and pursuing IRAP. We run our compliance program on Drata.

This is a hands-on role. When a control fails, a scan flags a vulnerability or an audit raises a finding, you fix it, whether that's tightening IAM in AWS, enforcing MFA, hardening configuration or scripting the evidence. You'll work with Technology on larger platform changes, but you won't just log issues and wait.

You'll own Glider's security assurance program end to end and run AML/CTF compliance day to day with the CEO, Glider's appointed AML/CTF Compliance Officer. Like the rest of Glider, this function is AI-native: you'll use AI tools every day to work faster and scale assurance.

Certifications & Audits

• SOC 2 Type 2: run controls through each observation period, fix exceptions, and lead the annual audit.
• ISO 27001: lead certification, maintain the ISMS scope, Statement of Applicability and risk treatment plan, run internal audit and management review, and see us through Stage 1, Stage 2 and surveillance audits.
• IRAP: map controls to the ASD ISM and Essential Eight, implement the technical changes needed to close gaps, prepare the System Security Plan and work with our IRAP assessor to completion.
• Maintain one control set mapped across SOC 2, ISO 27001 and the ISM, and keep Glider audit-ready at all times.

Hands-On Security Engineering & Remediation

• AWS: find and fix misconfigurations in IAM, logging, encryption, security groups, S3 and backups, using Security Hub, GuardDuty and Config.
• Identity: administer and harden our identity provider, including SSO, MFA, role-based access and deprovisioning.
• Endpoints: manage device compliance through MDM (encryption, patching, EDR).
• Code and CI/CD: maintain branch protection, required reviews, secrets scanning and dependency scanning.
• Vulnerabilities: triage scanner and pen test findings, fix what's in scope, and drive platform fixes with Technology to closure.
• Essential Eight: implement and evidence maturity improvements.
• Automation: write scripts (Python, Bash) and infrastructure-as-code to remediate issues, enforce configuration and collect evidence.
• All production changes go through change management with Technology approval.

Drata

• Own Drata as system administrator.
• Configure and fix integrations (AWS, identity, code, HR, devices), and build custom tests where standard coverage falls short.
• Resolve failing tests directly where possible.
• Manage personnel compliance, vendor risk (including AI providers), framework mappings, our trust centre and our questionnaire answer library.
• Own the information security policy suite and the annual review cycle.
• Make sure policies match how systems are actually configured, and fix whichever is wrong.
• Maintain AML/CTF policies (approved by the Compliance Officer).
• Maintain the risk register and deliver assigned technical treatments.
• Run quarterly access reviews and remove excess access.
• Maintain privacy controls under the Australian Privacy Principles.
• Support PCI DSS where customers require it.

AML/CTF Operations

• Keep the ML/TF risk assessment current, for Compliance Officer sign-off.
• Run KYC/KYB and due diligence on merchant onboarding, escalating higher-risk cases.
• Run sanctions and PEP screening.
• Review transaction monitoring alerts.
• Draft suspicious matter and annual compliance reports.
• Run AML/CTF and security awareness training.

Customer & Partner Assurance

• Answer security questionnaires and due-diligence requests from customers, banks, government and partners, including technical architecture questions.
• Prepare security material for sales and partner reviews.

AI-Enabled Compliance

• Use AI to draft policies, map controls, write remediation scripts, prepare evidence narratives and complete questionnaires.
• Build and document repeatable AI-assisted workflows.
• Ensure safe AI use: approved tools, appropriate data handling, and human review before anything reaches auditors, regulators, customers or production.
• Support governance of AI features in our platform.

Success Measures (First 12–18 Months)

• SOC 2 Type 2 recertified with no unresolved exceptions.
• ISO 27001 certified.
• IRAP assessment completed.
• Drata control health consistently green.
• Vulnerabilities and findings fixed within agreed SLAs.
• Measurable Essential Eight maturity improvement.
• Policies current, accepted by all staff and matching actual configuration.
• Merchant checks and monitoring reviews on time and documented.
• AI-assisted and scripted workflows delivering measurably faster turnaround.

Ideal Background & Experience

Required

• 4–6+ years in security engineering, GRC or security compliance at a SaaS, payments, fintech or regulated business, with a record of fixing issues, not just reporting them.
• Hands-on AWS security (IAM, logging, encryption, networking, Security Hub, GuardDuty).
• Experience administering an identity provider (e.g. Google Workspace, Okta, Entra ID) and MDM (e.g. Jamf, Kandji, Intune).
• Scripting in Python, Bash or PowerShell.
• Led a company through SOC 2 Type 2 and ISO 27001 audits.
• Administered Drata, Vanta or similar, including troubleshooting integrations.
• Written and maintained information security policies.
• Working knowledge of KYC/KYB and AML controls, ideally under the Philippine AMLA/AMLC or BSP regime or another FATF-aligned framework.
• Confident daily use of AI tools such as Claude or ChatGPT, including for code.

Preferred

• Drata, including custom tests.
• Terraform or CloudFormation.
• Secure SDLC tooling (GitHub Advanced Security, Snyk, Dependabot).
• AWS Security Specialty, ISO 27001 Lead Implementer/Auditor, CISA or CISM.
• AI governance frameworks (ISO/IEC 42001, NIST AI RMF).
• Australian AML/CTF and AUSTRAC knowledge (we'll help you learn).
• Philippine Data Privacy Act and Australian Privacy Principles.
• Remote work with Australian, US or UK companies.
• PCI DSS exposure.
• Fixer mindset: sees a gap and closes it.
• Comfortable in cloud consoles, config files and scripts.
• Structured, detail-oriented and reliable.
• Owns outcomes and follows through.
• AI-native, and checks AI output carefully.
• Works independently and remotely, mostly in writing.
• Raises issues early.
• Turns frameworks into simple, automated workflows.