Compliance Program Manager - Dora

OpenFX; New York (NY); On-site; USD 101,000 - 157,000; Full time

Benefits offered by this job

Equity

Growth opportunities

Impact on fintech

Job summary

OpenFX is seeking a Security & Compliance Engineer in Amsterdam to turn regulatory requirements into real, running controls and prove them to auditors. This senior role demands hands-on experience implementing DORA in production and delivering provable security across cloud and application layers.

You will own audit readiness for DORA, GDPR, SOC 2, ISO 27001 and partner with Legal, Compliance, and Engineering to embed compliant security across AWS, Kubernetes, and applications, ensuring evidence

Qualifications

• 6+ years in security engineering, cloud security, or compliance-focused security roles.
• Hands-on experience implementing DORA in production environments (ICT risk management, incident classification and reporting, vendor oversight).
• GDPR implementation experience is a strong bonus.
• Experience supporting SOC 2 and/or ISO 27001 audits (strong plus).
• Ability to translate regulatory requirements into technical controls.
• Strong working knowledge of AWS security fundamentals (IAM, logging, encryption).
• Comfortable owning auditor interactions and explaining systems clearly.
• Experience building or automating security/compliance processes (Python, Bash, Go).
• Accountability for an audit outcome.

Responsibilities

• Own audit-ready security controls across the platform.
• Design, implement, and maintain controls for DORA, GDPR, SOC 2, ISO 27001 and future regional requirements.
• Ensure controls are enforced across AWS, Kubernetes, and applications.
• Be the technical counterpart to Legal, Compliance & Risk.
• Translate regulatory language into concrete security mechanisms.
• Partner with Legal and Compliance to monitor new regulations and assess technical impact.
• Decide what is "good enough" vs. over-engineered for compliance.
• Run audits and manage evidence collection, walkthroughs, and remediation tracking.
• Build repeatable, automated evidence pipelines instead of last-minute scrambles.
• Be the person auditors trust when they ask, "Show me how this actually works."
• Embed compliance into the platform and work with engineering to design secure-by-default systems.
• Ensure logging, access controls, encryption, monitoring, and change management meet regulatory expectations.
• Automate compliance wherever possible
• Build tooling and scripts to validate controls (access reviews, logging coverage, config drift).
• Reduce manual compliance work over time by pushing checks into code and infrastructure.

Skills

Security engineering

DORA implementation

GDPR

SOC 2 / ISO 27001

Regulatory translation

AWS security

Auditor interaction

Scripting (Python, Bash, Go)

Audit ownership

Tools

Kubernetes

AWS GuardDuty

AWS Config

AWS Security Hub

SAST/DAST tooling

Python

Bash

Go

Job description

About Us

OpenFX is on a mission to move money as freely as data, unrestricted by time zones, banking hours, or legacy systems. We are building the infrastructure that will power the next generation of cross-border payment systems for institutions. The team's execution has been exceptional, and we're scaling at a remarkable pace. Our stellar early team comes with experience in companies like J.P. Morgan, Goldman Sachs, FalconX, Paypal, Affim, Polygon, Kraken, Nium & others. We're backed by Accel, Lightspeed, NfX and other top-tier investors.

Role Overview

We are looking for a Security & Compliance Engineer to turn regulatory requirements into real, running controls — and then prove to auditors that they work. This is a senior, hands-on role for someone who thrives in fast-paced, heavily regulated environments and knows how to make compliance provable in production rather than on paper. OpenFX is expanding across Europe in a heavily regulated financial environment. As we scale into EU markets, regulators, auditors, and enterprise partners expect provable, continuously operating security controls — not slide decks or one-off audits. Compliance requirements (DORA, GDPR, SOC 2, ISO 27001, and region-specific regulations) are increasing faster than our ability to operationalize them, and this role exists to close that gap. This role is based in Amsterdam, Netherlands (EU/EEA).

Key Responsibilities

• Own audit-ready security controls
• Design, implement, and maintain technical and operational controls for DORA, GDPR, SOC 2, ISO 27001, and future regional requirements.
• Ensure controls are not just documented, but actually enforced in AWS, Kubernetes, and application layers.
• Be the technical counterpart to Legal, Compliance & Risk
• Translate regulatory language into concrete security mechanisms.
• Partner with Legal and Compliance to monitor new regulations and assess technical impact.
• Decide what is "good enough" vs. over-engineered for compliance.
• Run audits instead of reacting to them
• Own audit preparation, evidence collection, walkthroughs, and remediation tracking.
• Build repeatable, automated evidence pipelines instead of last-minute scrambles.
• Be the person auditors trust when they ask, "Show me how this actually works."
• Embed compliance into the platform
• Work with engineering to design systems that are secure by default and defensible to regulators.
• Ensure logging, access controls, encryption, monitoring, and change management meet regulatory expectations.
• Automate compliance wherever possible
• Build tooling and scripts to continuously validate controls (access reviews, logging coverage, config drift).
• Reduce manual compliance work over time by pushing checks into code and infrastructure.

What we are looking for

Must-haves:

• 6+ years in security engineering, cloud security, or compliance-focused security roles
• Hands-on, operational experience implementing DORA in a production/regulated environment (not advisory only) — e.g. ICT risk management, incident classification and reporting, third-party/ICT vendor oversight, and digital operational resilience testing.
• GDPR implementation experience is a strong bonus.
• Experience supporting SOC 2 and/or ISO 27001 audits (strong plus).
• Ability to translate regulatory requirements into technical controls.
• Strong working knowledge of AWS security fundamentals (IAM, logging, encryption, networking).
• Comfortable owning auditor interactions and explaining systems clearly.
• Experience building or automating security/compliance processes (Python, Bash, Go, etc.).
• Accountability for an audit outcome — if you've never owned one, this role is not a fit.

What helps you stand out:

• Experience securing Kubernetes environments.
• Familiarity with AppSec tooling (SAST/DAST, manual testing).
• Experience with AWS security services (GuardDuty, Config, Security Hub).
• Prior work in fintech, payments, or regulated infrastructure.
• Security or compliance certifications (CISSP, CISA, ISO 27001 Lead Implementer, AWS Security).
• Familiarity with EU financial regulators and national competent authorities (e.g. DNB/AFM in the Netherlands, EBA/ESMA).

What We Offer

• Competitive salary and benefits package.
• Equity in a rapidly growing company.
• Opportunity to work in a fast-paced startup at the forefront of fintech innovation.
• Opportunity to make a significant impact on global financial infrastructure.
• Collaborative work culture with emphasis on personal and professional growth.

We are committed to building a diverse and inclusive workplace. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.