Security Engineering Lead

Dovetail is the Customer Intelligence Platform for the entire organization. We unify fragmented feedback from every touchpoint, including sales calls, support tickets, and research, into a single AI-powered intelligence layer that empowers every team to build, sell, and serve with confidence. Founded in 2017, we are a team of 100+ across our offices in Sydney and San Francisco, working with thousands of teams from Fortune 500 companies to the world’s most innovative startups.

The best never guess. We help teams turn the noise of thousands of customer interactions into the signal required to move faster, prioritize better, and drive revenue.

The role

Roughly 15% of the Fortune 500 trust us with their customer data. That trust is the product. As our Security & Compliance Lead you own the governance, risk and compliance function that proves it, end to end, across SOC 2, ISO/IEC 27001 and ISO/IEC 42001.

This is a compliance role in a company that ships every day. The certifications matter, but so does what sits underneath them, and we would rather automate a control than evidence it by hand twice a year. You will start with deep GRC ownership and we expect you to push hard into security engineering from there, building the tooling and automation that makes compliance a by-product of how we work rather than a quarterly scramble. Dovetail is one of Australia's most AI forward engineering teams and you will have the runway, the tooling and the support to make that move.

You will also be shaping what governance looks like for AI products that are genuinely new. We were early to ISO/IEC 42001 and the questions our enterprise customers ask about model use, data handling and agentic workflows do not have settled answers yet. You get to write them.

This is a full-time individual contributor role reporting into engineering leadership. It is in person first (4 days a week) from our Surry Hills HQ.

What you'll do here

• Own security risk. Maintain the risk register, run risk assessments on new products and features, drive mitigations to close with the teams who own them, and manage third party and vendor risk as our supply chain grows.

• Own our compliance programme. Run SOC 2, ISO/IEC 27001 and ISO/IEC 42001 certification and surveillance cycles end to end, including scoping, control design, evidence, internal audit and the external auditor relationship.

• Be the technical voice in enterprise deals. Handle security questionnaires, customer trust reviews and due diligence for some of the largest companies in the world, and work with sales and legal to unblock them quickly.

• Automate the boring parts. Build and improve tooling that collects evidence, monitors control drift and reports posture continuously, working alongside platform engineering rather than handing them a ticket.

• Grow into hands-on security engineering. Pick up detection and response tooling, cloud security posture work across AWS, and vulnerability management, with the support to build genuine engineering depth.

• Set the standard for AI governance. Define how we assess, document and control AI systems, model providers and agentic features, and stay ahead of where frameworks like the EU AI Act and the NIST AI Risk Management Framework are heading.

• Be part of security incident response. Contribute to our response process and help mature how we detect, escalate and learn from incidents.

• Build the security culture. Work with and mentor engineers, product and design so that good security decisions get made without you in the room.

Your background

…