Security Engineering Lead

About Dovetail

Dovetail is a Customer Intelligence Platform that consolidates disparate feedback from numerous touchpoints such as sales calls, research, and customer support tickets, into a unified AI-driven intelligence layer. This empowers teams across organizations to build, sell, and support their products and services confidently. Founded in 2017, Dovetail has a 100+ member team based in Sydney and San Francisco, serving a diverse client base from Fortune 500 corporations to innovative startups worldwide.

Dovetail’s mission is to transform overwhelming customer interactions into meaningful insights that enable quicker action, enhanced prioritization, and increased revenue.

Role Overview

As the Security & Compliance Lead at Dovetail, you will take full ownership of the governance, risk, and compliance (GRC) functions, with responsibilities spanning certifications like SOC 2, ISO/IEC 27001, and the emerging ISO/IEC 42001 standard. You will operate in a fast-moving software environment, focusing not only on meeting compliance requirements but also on integrating automation and tooling to embed compliance seamlessly into daily workflows rather than relying on manual processes.

You will have the opportunity to pioneer governance frameworks for novel AI products, shaping policies on model usage, data handling, and agentic workflows, addressing complex questions posed by enterprise clients and evolving frameworks like the EU AI Act and NIST AI Risk Management Framework.

This is a full-time position reporting to engineering leadership and requires primarily onsite presence in Sydney, with approximately four days per week at the Surry Hills headquarters.

Responsibilities

• Maintain ownership of security risk management, including maintaining the risk register, conducting risk assessments for new products and features, driving mitigation efforts in collaboration with respective teams, and managing third-party/vendor risks within the supply chain.
• Lead the end-to-end compliance program covering SOC 2, ISO/IEC 27001, and ISO/IEC 42001 certifications and surveillance cycles: scoping, control design, evidence collection, internal audits, and liaison with external auditors.
• Act as the technical representative during enterprise sales and security reviews, managing security questionnaires, trust evaluations, and due diligence processes in cooperation with sales and legal teams to streamline customer deals.
• Develop and enhance tools to automate routine compliance tasks such as evidence collection, monitoring control drift, and producing continuous security posture reports by collaborating closely with platform engineering teams.
• Expand expertise into security engineering functions including detection and response tooling, cloud security posture management on AWS, and vulnerability management with organizational support.
• Establish standards for AI governance by defining processes for assessing, documenting, and controlling AI systems, including managing relationships with model providers and overseeing agentic features.
• Participate in the security incident response mechanism by contributing to incident detection, escalation, and post-incident learning improvements.
• Foster a culture of security by mentoring engineers, product managers, and designers to make informed security decisions autonomously.

Requirements

• Extensive experience managing governance, risk, and compliance programs, specifically leading SOC 2 and ISO/IEC 27001 initiatives in a software company environment, with a focus on controls that both satisfy auditors and genuinely reduce risk.
• Knowledge or strong interest in AI compliance and familiarity with standards such as ISO/IEC 42001 and emerging AI assurance frameworks, with willingness to deepen expertise in this domain.
• Technical competence to engage effectively with engineers on cloud security architecture, including familiarity with AWS security services like GuardDuty, Security Hub, Inspector, and Detective; as well as experience with EKS, TypeScript, and infrastructure as code tools such as Pulumi or Terraform is advantageous.
• A proactive approach toward building solutions and automations to replace manual compliance processes, with a desire to develop deeper technical skills over time.
• Experience navigating enterprise customer environments, engaging procurement and security review teams, and facilitating deal progress without overpromising.
• Adaptability and pragmatism in a dynamic environment, comfortable dealing with ambiguity, resourceful problem-solving, and adjusting to shifting priorities.
• A strong focus on quality delivery, maintaining high standards by prioritizing scope reduction over quality compromise.
• Excellent and succinct communication skills, capable of articulating risk clearly and effectively to diverse audiences including engineers, board members, and customer CISOs.

Benefits

• Equity opportunities alongside competitive base salary, aligning long-term incentives.
• An office culture designed for in-person collaboration in Sydney with a flexible remote arrangement for US teams.
• Company-wide social engagement through interest groups and celebrations of milestones and culture.
• Flexible learning and development options offering either a $3000 educational allowance or up to $1000 for wellness initiatives.
• Generous paid time off including four weeks’ accrued leave, floating public holidays, and additional bonus days throughout the year.
• Opportunity to work remotely from anywhere globally for up to four weeks annually.
• Comprehensive parental leave policies with 20 weeks for primary caregivers and 12 weeks for secondary caregivers plus support for reintegration.
• Additional four weeks leave after four years of tenure to promote work-life balance.
• Extensive US healthcare benefits including health, dental, vision, and 401(k) options provided through Sequoia.

Company Commitment

Dovetail fosters an inclusive workplace where individuals can bring their authentic selves and is committed to encouraging applications from candidates representing underrepresented groups. The company expects its team members to engage thoughtfully and pragmatically with AI to enhance work quality, velocity, and impact.