<p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="5:1-5:13;67-79"><strong>About Us</strong></p> <p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="7:1-7:543;81-623">OpenFX is on a mission to <strong>move money as freely as data, unrestricted by time zones, banking hours, or legacy systems.</strong> We are building the infrastructure that will power the next generation of cross-border payment systems for institutions. The team's execution has been exceptional, and we're scaling at a remarkable pace. Our stellar early team comes with experience in companies like J.P. Morgan, Goldman Sachs, FalconX, Paypal, Affirm, Polygon, Kraken, Nium & others. We're backed by Accel, Lightspeed, NfX and other top-tier investors.</p> <p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="9:1-9:18;625-642"><strong>Role Overview</strong></p> <p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="11:1-11:341;644-984">We are looking for a <strong>Security & Compliance Engineer</strong> to turn regulatory requirements into real, running controls — and then prove to auditors that they work. This is a senior, hands-on role for someone who thrives in fast-paced, heavily regulated environments and knows how to make compliance provable in production rather than on paper.</p> <p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="13:1-13:441;986-1426">OpenFX is expanding across Europe in a heavily regulated financial environment. As we scale into EU markets, regulators, auditors, and enterprise partners expect provable, continuously operating security controls — not slide decks or one-off audits. Compliance requirements (DORA, GDPR, SOC 2, ISO 27001, and region-specific regulations) are increasing faster than our ability to operationalize them, and this role exists to close that gap.</p> <p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="15:1-15:368;1428-1795">You will own the security controls and evidence that regulators and auditors care about, end to end — from translating regulatory language into concrete mechanisms through to audit walkthroughs and remediation. You will partner closely with Legal, Compliance, Risk, and engineering to ensure compliance is built into the platform rather than bolted on after the fact.</p> <p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="17:1-17:55;1797-1851">This role is based in Amsterdam, Netherlands (EU/EEA).</p> <p class="font-claude-response-body break-words whitespace-normal" data-sourcepos="19:1-19:26;1853-1878"><strong>Key Responsibilities:</strong></p> <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="21:1-37:92;1880-3270"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="21:1-23:111;1880-2169"><strong>Own audit-ready security controls</strong> <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="22:3-23:111;1922-2169"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="22:3-22:139;1922-2058">Design, implement, and maintain technical and operational controls for DORA, GDPR, SOC 2, ISO 27001, and future regional requirements.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="23:3-23:111;2061-2169">Ensure controls are not just documented, but actually enforced in AWS, Kubernetes, and application layers.</li> </ul> </li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="24:1-27:69;2170-2464"><strong>Be the technical counterpart to Legal, Compliance & Risk</strong> <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="25:3-27:69;2235-2464"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="25:3-25:69;2235-2301">Translate regulatory language into concrete security mechanisms.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="26:3-26:94;2304-2395">Partner with Legal and Compliance to monitor new regulations and assess technical impact.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="27:3-27:69;2398-2464">Decide what is "good enough" vs. over-engineered for compliance.</li> </ul> </li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="28:1-31:83;2465-2765"><strong>Run audits instead of reacting to them</strong> <ul class="[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3" data-sourcepos="29:3-31:83;2512-2765"> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="29:3-29:88;2512-2597">Own audit preparation, evidence collection, walkthroughs, and remediation tracking.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="30:3-30:85;2600-2682">Build repeatable, automated evidence pipelines instead of last-minute scrambles.</li> <li class="font-claude-response-body whitespace-normal break-words pl-2" data-sourcepos="31:3-31:83;2685-2765"