---
title: 'Chief Information Security Officer (CISO) at Hawk'
canonical: 'https://feeny.ai/job/chief-information-security-officer-ciso-hawk-munich-1k5wxrfcxcg9'
type: 'job'
last_seen: '2026-10-18'
---

# Chief Information Security Officer (CISO) at Hawk

- **Company:** Hawk
- **Location:** Munich, Germany
- **Employment:** full-time
- **Posted:** 2026-10-06
- **Last confirmed live:** 2026-10-18
- **Apply:** https://jobs.ashbyhq.com/hawk/39f59175-818d-41aa-b0d9-f9f6e0d639f0

## Job description

## About Us

Hawk is the leading provider of AI-supported anti-money laundering and fraud detection technology. Banks and payment providers globally are using Hawk’s powerful combination of traditional rules and explainable AI to improve the effectiveness of their AML compliance and fraud prevention by identifying more crime while maximizing efficiency by reducing false positives. With our solution, we are playing a vital role in the global fight against Money Laundering, Fraud, or the financing of terrorism. We offer a culture of mutual trust, support and passion – while providing individuals with opportunities to grow professionally and make a difference in the world.

Hawk builds AI-powered financial crime detection (AML, transaction monitoring, and fraud prevention) for global tier-1 banks, payment processors, and high-growth fintechs. Because our platform analyzes real-time payment streams and sensitive financial data, security is not an administrative support function—it is our primary product promise. We are looking for a technically grounded, hands-on CISO to own our global security posture end-to-end. This is a true player-coach leadership role. You will lead a dedicated team of four domain specialists while staying close enough to the technology to review cloud architecture, triage high-severity vulnerabilities, command critical incident responses first-hand, and debate technical security controls peer-to-peer with customer bank CISOs.

## Why This Role Matters

- Global Regulatory Scrutiny at Scale: We operate across key financial hubs including Germany, the UK, the US, Singapore, and a growing roster of international markets. With DORA enforceable across the EU and heightened ICT risk rules globally, our banking clients expect documented operational resilience, continuous testing, and verified controls across all jurisdictions.
- Modern Attack Surfaces & Supply Chain Threats: Our multi-tenant and single-tenant cloud environments (AWS/GCP) process massive transaction throughput. Alongside defending against emerging supply chain vulnerabilities—from open-source dependencies to third-party build pipelines—you will need to deeply understand our AI approach and actively help harden our tooling, harnesses, and pipelines.
- Enterprise Deal Velocity: Enterprise security reviews can either stall deals or close them. You will partner with our commercial teams to turn security questionnaires, risk mitigation, and architecture audits into enterprise trust and closed contracts.

Organizational Structure: The Four Domains You will lead, mentor, and set technical direction for four specialized functional areas:

- Application Security: Secure SDLC, automated CI/CD security gates (SAST/DAST/SCA), software supply chain defense, secure coding standards, AI harnesses and pipeline hardening.
- Corporate Security: Zero Trust architecture, IAM/SSO, distributed endpoint defense (EDR/XDR), threat hunting, infrastructure access.
- Compliance & Governance: DORA implementation, ISO 27001, SOC 2 Type II, Third-Party Risk Management (TPRM), multi-jurisdiction regulatory audits, risk registry ownership.
- Data Protection: Solely dedicated to data protection: GDPR compliance, privacy governance, data subject rights, and statutory privacy regulatory requirements.

Core Accountabilities

1. Hands-On Technical Leadership, Engineering Integration & AI Hardening

- Secure Coding Standards & SDLC: Establish and enforce secure coding baselines directly within engineering workflows. Ensure automated vulnerability scanning, SBOM tracking, and security gates are integrated into GitHub/GitLab CI/CD pipelines.
- Software Supply Chain Defense: Protect build systems, dependencies, and deployment pipelines against supply chain tampering, compromised packages, and upstream vulnerabilities.
- AI Tooling & Pipeline Hardening: Deeply understand our AI approach and work closely with engineering to harden our systems. Personally evaluate and implement protective mechanisms—including secure AI harnesses, container sandboxing, and runtime guardrails around AI tooling and workflows.
- Vulnerability Lifecycle Management: Set strict remediation SLAs for CVEs and cloud misconfigurations. Directly arbitrate vulnerability severity, triage zero-days, and collaborate with engineering leads to ensure rapid remediation without stalling release velocity.
- Zero Trust & Cloud Infrastructure: Architect and drive our group-wide Zero Trust roadmap across AWS and GCP environments, enforcing least-privilege IAM policies, network micro-segmentation, and secure developer access.

1. Commercial Trust & Customer Engagement

- Peer-to-Peer Customer Dialogue: Act as the senior technical authority in enterprise sales cycles, engaging directly with bank CISOs, InfoSec panels, and procurement leads to validate Hawk's architecture, threat models, and operational controls.
- Accelerating Enterprise Deal Velocity: Modernize vendor due diligence by replacing reactive security questionnaires with standardized evidence packages, continuous compliance portals, and pre-packaged architectural audits that win customer confidence quickly.
- Converting Security into a Value Driver: Turn our robust security baseline into a core sales differentiator, helping commercial teams demonstrate to prospect banks why Hawk's defense posture makes us their lowest-risk vendor.

1. Risk Registry, Compliance & Governance Leadership

- Company Risk Registry Ownership: Act as the executive owner of the company-wide Risk Registry. Go beyond cataloging risks: prioritize exposures dynamically, secure cross-functional executive buy-in to fund and execute mitigations, and transform risk management into concrete business enablement and revenue protection.
- Third-Party Risk Management (TPRM): Oversee vendor risk tiering, supply chain vetting, and continuous monitoring for third-party vendors and cloud sub-processors, executed directly through the Compliance function.
- Audit & Regulatory Leadership: Maintain existing ISO 27001 and SOC 2 Type II programs with zero major non-conformities across an expanding international perimeter.
- DORA Implementation: Enforce end-to-end compliance with the EU Digital Operational Resilience Act—specifically ICT risk management, third-party vendor oversight, operational resilience testing, and ICT incident reporting.
- Multi-Jurisdiction Alignment: Adapt policies proactively to meet global financial standards across the EU, UK, US, Singapore, and upcoming expansion markets.
- Executive & Board Reporting: Translate technical cyber risks into clear business metrics (KRIs, risk heat maps, burn-down rates) for the CEO and Board of Directors.

1. Frontline Incident Response & Operational Resilience

- First-Hand Incident Commander: Serve as the hands-on incident commander during Sev-1/Sev-2 security incidents. Lead technical investigations, root-cause analyses, log forensics, and technical debriefs directly alongside your team.
- Breach Notification & External Escalation: Direct regulator, law enforcement, and client communications within mandatory statutory windows under GDPR and DORA guidelines.
- Testing & Tabletop Drills: Design and execute technical red team engagements, threat-led penetration tests (TLPT), and crisis simulations with both technical engineers and the executive board.

12-Month Success Metrics:

- Commercial Velocity: Enterprise bank security assessments clear with zero high-severity blockers, accelerating enterprise contract closures.
- Proactive Risk Registry: The company risk registry is fully operationalized with executive buy-in, systematically driving down enterprise risk while supporting business expansion.
- Regulatory & Audit Record: DORA compliance program is operational; ISO 27001 and SOC 2 renew cleanly across all operating regions.
- Engineering & AI Hardening: Software supply chain security controls, secure coding standards, and AI harness guard rails are fully integrated into engineering CI/CD workflows.
- Resilient Team Operations: The four-person security team executes with high autonomy, defined KPIs, and high cross-functional trust across the company.

Candidate Profile:

- Practitioner Foundations: Proven background as a hands-on security practitioner (e.g., former security engineer, AppSec specialist, cloud security architect, or technical penetration tester) who has advanced into security leadership.
- Player-Coach Track Record: Demonstrated ability to manage and grow a small team of domain experts while personally reviewing technical configurations, auditing cloud policies, or investigating an alert.
- Commercial & CISO-to-CISO Fluency: Experience debating architecture, supply chain controls, and threat postures directly with enterprise bank CISOs and security evaluation boards to clear deal roadblocks.
- AI & Supply Chain Defense Fluency: Ability to quickly understand our AI architecture, implement hands-on controls to harden AI tooling (including AI harnesses and sandboxing), and protect CI/CD pipelines against software supply chain risks.
- Risk Registry Execution: Demonstrated ability to maintain a living risk registry, articulate risk trade-offs to non-technical executives, and rally engineering and commercial buy-in to remediate risks.
- FinTech & Regulated SaaS Background: Multi-year leadership experience in a B2B SaaS, FinTech, or banking platform handling sensitive financial or transactional data under regulatory oversight (e.g., DORA, ISO 27001, SOC 2, GDPR).
- Technical Breadth: Strong practical understanding of AWS and GCP security primitives, container and Kubernetes security, modern IAM/SSO, API gateways, and EDR/XDR toolchains.

Bonus:

- Industry certifications reflecting technical or managerial competence (e.g., CISSP, CISM, CCSP, OSCP).
- Direct experience securing real-time event-streaming architectures.
- German language proficiency (conversational or fluent) is a strong advantage.

## About Hawk

## Company Overview
- **One-liner**: Hawk provides AI-powered anti-money laundering (AML), fraud prevention, and sanctions screening solutions to help financial institutions detect financial crime more efficiently.
- **Entity Type**: Private (Series C, total funding $83.97M)
- **Headquarters**: Munich, Germany
- **Founded**: 2018
- **Founders**: Wolfgang Berner and Tobias Schweiger

## Core Business
- **Primary industry**: Financial crime compliance technology (AML, fraud, sanctions screening)
- **Target customers**: B2B – banks, payment firms, neobanks, fintechs, and cryptocurrency companies
- **Mission**: “Help financial institutions fight financial crime more effectively and efficiently using AI to detect more suspicious activity and reduce unnecessary alerts.”

## Products & Services
- **AML Transaction Monitoring**: AI-driven detection of suspicious transactions, reducing false positives by 70% and investigation time by 62%.
- **Screening (Watchlist & Sanctions)**: Comprehensive watchlist screening to block risky clients and sanctioned payments.
- **Fraud Prevention**: Real-time fraud blocking across all payment rails and channels.
- **FRAML (Fraud & AML Convergence)**: Unified view of financial crime risks to break down data silos and catch 30% more fraudulent customers.
- **Modular Platform**: API-first architecture that integrates with existing core banking and data systems; supports SaaS or private cloud deployment; self-serve rule creation.

## Market Standing
- **Valuation**: Not publicly available.
- **Key Metric**: Total funding $83.97M (Series C of $56.97M raised ~1 year ago).
- **Notable Investors**: BlackFin Capital Partners, Picus Capital, Sands Capital, DN Capital, Coalition (and 20+ others).
- **Growth Signals**: Recognized as a “Strong Performer” in Forrester Wave™ Anti-Money-Laundering Solutions (Q2 2025); winner of Celent’s Advanced Technology award; named Daniel Marshall as Chief Customer Officer to drive global AI growth; over 200 customers; 30+ nationalities on staff.

## Competitive Advantages
- **AI Precision & Explainability**: Fully transparent, auditable machine learning that regulators and teams can understand.
- **Reduced False Positives**: 70% fewer false alerts; 62% reduction in AML investigation time; 3–5x more true threats identified.
- **Flexible Deployment**: SaaS or private cloud with high-availability design; gradual AI adoption to avoid disruption.
- **Self-Serve Rule Setup**: Business users can create and adjust rules without IT or coding support.
- **Modular & Scalable**: One contract, multiple solutions; handles growing volumes and new markets.

## Strategic Focus
- Scaling globally and deepening AI adoption in financial crime compliance.
- Leading the convergence of AML and fraud prevention (FRAML) for mid-market banks and credit unions.
- Maintaining transparent AI governance to meet evolving regulatory demands.

## Why Work Here
- **Culture**: International team of 30+ nationalities; inclusive environment focused on fighting financial crime together.
- **Work Flexibility**: Flexible work location and schedules (remote/hybrid options available).
- **Mission-Driven**: Employees are motivated by protecting the financial system; values include “customer trust is our lifeblood” and “win.”
- **Awards & Recognition**: Winner of multiple industry awards; recognized by Celent and Forrester.
- **Engineering & AI Focus**: Opportunity to work on cutting-edge AI in a real-world, high-impact domain.

## Sources
1. [Hawk Careers](https://hawk.ai/careers)
2. [Hawk Homepage](https://hawk.ai/)
3. [Hawk About Us](https://hawk.ai/about-us)
4. [Hawk Jobs on Ashby](https://jobs.ashbyhq.com/hawk)
5. [CB Insights Company Profile](https://www.cbinsights.com/company/hawkai)

## Other roles at Hawk

- [Frontend Engineer - Agentic AI](https://feeny.ai/job/frontend-engineer-agentic-ai-hawk-munich-5exf85g70zhd) — Munich, Germany
- [Senior Pre-Sales Consultant](https://feeny.ai/job/senior-pre-sales-consultant-hawk-london-wbg8vawtv95k) — London, United Kingdom
- [Implementation Specialist](https://feeny.ai/job/implementation-specialist-hawk-london-cpdjd2hmde5c) — London, United Kingdom
- [Implementation Specialist](https://feeny.ai/job/implementation-specialist-hawk-munich-sw2kvy8b6cjy) — Munich, Germany
- [Customer Value Partner, APAC](https://feeny.ai/job/customer-value-partner-apac-hawk-malaysia-5ewhfc9grd9g) — Malaysia
- [Customer Value Partner](https://feeny.ai/job/customer-value-partner-hawk-london-gqds9tpgjv8m) — London, United Kingdom
- [Global Events Manager (East Coast)](https://feeny.ai/job/global-events-manager-east-coast-hawk-united-states-bmp3g5bxpwea) — United States
- [ABM Manager](https://feeny.ai/job/abm-manager-hawk-london-kzg1vkbdw6zx) — London, United Kingdom
- [Enterprise Account Director](https://feeny.ai/job/enterprise-account-director-hawk-london-xehvfwgyqmce) — London, United Kingdom
- [Head of Demand Generation, US](https://feeny.ai/job/head-of-demand-generation-us-hawk-united-states-745h0gz24pqy) — United States