---
title: 'Head of Security at Fresha'
canonical: 'https://feeny.ai/job/head-of-security-fresha-london-7p77h8cwqygw'
type: 'job'
last_seen: '2026-10-12'
---

# Head of Security at Fresha

- **Company:** Fresha
- **Location:** London, United Kingdom
- **Employment:** full-time
- **Work type:** onsite
- **Posted:** 2026-04-30
- **Last confirmed live:** 2026-10-12
- **Apply:** https://jobs.lever.co/fresha/a28e39ce-ecb0-41b5-80b2-637984ae69c0

## Job description

The AI-powered OS for beauty, wellness and self-care

## About Fresha

Fresha is the AI-powered operating system for the global beauty, wellness and self-care industry, connecting and powering everything from salons and barbers to spas, medspas, fitness studios and health practices. Trusted by millions of consumers and businesses worldwide. Fresha is used by 140,000+ businesses and 450,000+ stylists and professionals worldwide, processing over 1 billion appointments to date.

The company is headquartered in London, United Kingdom, with 15 global offices located across North America, EMEA and APAC. Fresha allows consumers to discover, book and pay for beauty and wellness appointments with local businesses via its marketplace, while beauty and wellness businesses and professionals use an all-in-one platform to manage their entire operations with an intuitive business software and financial technology solutions.

Fresha’s ecosystem gives merchants everything they need to run their business seamlessly by facilitating appointment bookings, point-of-sale, customer records management, marketing automation, loyalty, beauty products inventory and team management.

The consumer marketplace unlocks revenue potential for partner businesses by leveraging the power of online bookings and automated marketing through mobile apps and advanced integrations with major tech brands including Instagram, Facebook and Google.

## About the role

Reports to: VP of Security, IT and Compliance

We're looking for someone to own security end-to-end at Fresha. You'll shape the security strategy alongside the VP, build and run the controls that protect the business, and be the person everyone — engineers, execs, auditors, customers — looks to regarding security questions.

You'll work alongside the Head of Compliance (who sits under the same VP) as a peer. They own the frameworks, the audits, and the evidence. You own the actual security posture, the tooling, and the response. The two roles need each other to succeed, and we expect you to work closely together rather than carve out territory.

We're a payments business operating in a regulated space, with HIPAA and ISO 27001 behind us and PCI DSS, GDPR, and SOC 2 Type II ahead of us this year. The security bar is not theoretical.

To foster a collaborative environment that thrives on face-to-face interactions and teamwork, this role will be based in our dog-friendly office 5 days per week in London: The Bower, 207-122, Old Street, London EC1V 9NR.

## What you'll own

Security strategy and roadmap

- Shape the security strategy together with the VP — the VP sets direction at the exec level, you bring the ground truth, the technical depth, and the detailed plan that turns that direction into something real
- Own the security roadmap that falls out of it: what we're building, what we're retiring, what we're deferring, and why
- Make the call on where to invest day-to-day: tooling, headcount, external services, automation — within the strategic envelope agreed with the VP
- Translate that roadmap into something the exec team can actually read and fund

Controls and protections

- Deploy and run the security controls across the estate — endpoint, network, cloud, identity, application
- Make sure controls are actually working, not just deployed — continuous validation, not annual tick-boxing
- Partner with Engineering and IT to get controls in early, rather than bolted on after the fact

Penetration testing and vulnerability management

- Run the regular external pentest cadence — application, infrastructure — and make sure findings are triaged and closed
- Own the vulnerability management programme: scanning, prioritisation, SLAs, and closure
- Work with the Head of Compliance on the evidence side — they need clean data for audits, you need clean closure on the underlying issues. Same data, different purposes

Incident response

- Own the IR process end-to-end: detection, triage, containment, eradication, recovery, and post-incident review
- Run the on-call model, the playbooks, the tabletop exercises, and the tooling behind them
- Be the person in the room when something real happens, and the person writing the honest post-mortem afterwards

Threat intelligence and threat modelling

- Stand up a threat intelligence capability — somewhere past incidents, near-misses, industry reports, and internal telemetry get captured, tagged, and made useful
- Build this into a threat intel data warehouse that actually informs decisions: future threat modelling, control design, roadmap prioritisation, and tabletop scenarios. Not a dashboard nobody reads
- Run threat modelling as a routine practice, not a one-off — including automated threat modelling using AI against designs, code, and infrastructure changes

Emerging threats

- Keep a forward view on where the threat landscape is heading, especially around LLMs: prompt injection, model abuse, AI-augmented vulnerability scanning by attackers, and exposure of sensitive data through AI tooling
- Don't just react to what's hitting us today — make sure we're not blindsided by what's hitting everyone in 12 months
- Feed that view into the strategy conversation with the VP, and turn it into concrete roadmap items rather than slide decks

Security training and awareness

- Own the security-specific training content: phishing simulations, secure coding for engineers, threat modelling training, IR tabletop participation, and role-based training for anyone handling cardholder data, PHI, or other sensitive material
- Partner with the Head of Compliance — they run the overall training programme, cadence, and evidence; you bring the security substance and keep it current with the threat landscape
- Make the training actually useful. Engineers should walk away knowing something they didn't before, not clicking through slides to get a completion tick

Automation and AI

- Look at every recurring task in this function and ask "why is a human still doing this?" — triage, alert enrichment, vulnerability prioritisation, evidence gathering, threat modelling, IR runbooks
- Push existing tooling as far as it'll go, and fill the gaps with scripts, workflows, or AI where it makes sense
- Use LLMs sensibly for drafting, review, analysis, and automation — while being clear-eyed about where they introduce new risks we have to manage ourselves
- Treat the function's operating model as a product: fewer manual rituals each quarter, better coverage, faster response

Security advisory

- Be the go-to person for security questions across the business — architecture reviews, vendor assessments, new products, acquisitions, anything risky
- Give engineers a straight answer and a path forward, not a ticket queue and a policy link

## What we're looking for

- You've led security at a company operating under real regulatory pressure — payments, healthcare, financial services, or similar
- You've run incident response for real incidents, not just exercises, and you've written the post-mortems
- You understand modern attack surfaces: cloud, SaaS, identity, supply chain, application — and you don't reduce security to any one of them
- You've built or meaningfully improved a threat intel or threat modelling capability, not just consumed vendor feeds You're fluent with AI tools and comfortable building automation. "I'll wait for someone to build it for me" isn't the right mindset — but neither is "let's put an LLM on everything."You know the difference
- You're comfortable co-owning strategy with a VP — bringing strong opinions, challenging when it matters, and aligning once a direction is set
- You can hold your own with engineers on technical depth and with execs on business framing
- Bonus: experience with payments/PCI environments, offensive security background, or a track record of measurably reducing manual security work through automation

## How you'll work

You'll have a team to lead from day one, with scope to grow it as the roadmap demands. You'll work closely with the VP on strategy, and with the Head of Compliance, IT, Engineering, Infrastructure, and Product on execution. You'll be in front of customers and auditors often enough that polish matters. Expect to spend real time hands-on — in tooling, in incidents, in design reviews — not just managing.

Interview Process

- Screen Stage - Video-call with a member from the Talent Team (45-60min)
- 1st Stage - Interview with the VP of Security, IT & Compliance (60min)
- Final Stage - Video interview with CTO (60min) and Head of Talent (30min)

We aim to finalise the entire interview process and deliver feedback within 4 weeks.

Every job application received is reviewed manually by our talent team. While we strive to assess applications within 7 days, the sheer volume of talented individuals expressing interest may occasionally extend this timeframe

Inclusive workforce

At Fresha, we are creating a culture where individuals of all backgrounds feel comfortable.

We want all Fresha people to feel included and truly empowered to contribute fully to our vision and goals. Everyone who applies will receive fair consideration for employment.

We do not discriminate based on race, colour, religion, sex, sexual orientation, age, marital status, gender identity, national origin, disability, or any other applicable legally protected characteristics in the location in which the candidate is applying.

If you have any accessibility requirements that would make you more comfortable during the interview process and/or once you join, please let us know so that we can support you.

## About Fresha

## Company Overview
- **One-liner**: Fresha operates the world’s leading marketplace platform for the beauty, wellness, and self-care industry, connecting consumers with local professionals and providing businesses with an all-in-one booking and management software.
- **Entity Type**: Private (Series C)
- **Headquarters**: London, United Kingdom
- **Founded**: 2015
- **Founders**: Not publicly available (company founded in 2015 under Surge Ventures Inc)

## Core Business
- **Primary industry/industries**: Beauty & Wellness Technology, Marketplace Platform, SaaS
- **Target customers**: B2B (salons, barbers, spas, medspas, wellness studios) and B2C (consumers booking self-care services)
- **Mission or purpose statement**: To reshape the global beauty and wellness industry by providing a seamless, all-in-one platform for businesses and consumers.

## Products & Services
- **Fresha Marketplace (Consumer App)**: A mobile and web platform for consumers to discover, book, and pay for beauty and wellness appointments with local professionals.
- **Fresha Business Platform (SaaS)**: An all-in-one business management software for salons, spas, and clinics. Includes appointment scheduling, point-of-sale (POS), client management, marketing automation, loyalty programs, inventory management, and team coordination.
- **Fresha Payments**: Integrated payment processing and financial services for partner businesses.
- **Marketing & Growth Tools**: Automated marketing, SEO tools, and integrations with Instagram, Facebook, and Google to help businesses attract new clients.

## Market Standing
- **Valuation/Market Cap**: Not disclosed (private company)
- **Key Metric**: $428M annual revenue (latest estimate); $35 billion+ in gross merchandise volume (GMV) processed to date; 130,000+ partner businesses; 450,000+ professionals; 1 billion+ appointments booked.
- **Notable Investors/Partners**: Raised $52.5M in Series C (December 2021) and additional funding via convertible notes. Specific lead investors not listed in provided data, but prior rounds include seed, Series A, and convertible notes from multiple investors.
- **Growth Signals**: 47.9% headcount growth YoY (+267 people); operates in 120+ countries; offices in 12 locations across 6 countries; strong talent inflow from competitors like Treatwell, Booksy, and Mindbody; 114 active job postings.

## Competitive Advantages
- **Scale & Network Effects**: With 130,000+ businesses and 450,000+ professionals, Fresha has a massive, self-reinforcing marketplace. More consumers attract more businesses, and vice versa.
- **All-in-One Platform**: Combines booking, payments, marketing, and inventory management in a single solution, reducing the need for multiple vendors for salon owners.
- **Global Reach**: Operating in 120+ countries with localized offices in key markets (UK, US, Poland, Australia, UAE, Netherlands, etc.), giving it a truly global footprint.
- **Zero-Commission Model (for businesses)**: Unlike many competitors, Fresha does not charge a commission on bookings, making it highly attractive for small businesses.

## Strategic Focus
- **Global Expansion**: Opening new offices and hiring in emerging markets (Brazil, South Africa, Philippines, Mexico) to capture more of the global beauty and wellness market.
- **Product Development**: Continued investment in engineering, data, and product teams to enhance the platform’s AI, personalization, and automation capabilities.
- **Enterprise & Multi-Location Growth**: Targeting larger salon chains and multi-location businesses with advanced features and dedicated account management.
- **Payments & Financial Services**: Deepening the payments and fintech layer to drive revenue and stickiness.

## Why Work Here
- **Growth & Scale**: Fresha is growing rapidly (47.9% headcount growth YoY) and processes over 1 billion appointments. Employees can have a massive impact on a platform used by millions.
- **Global & Distributed**: With offices in London, Warsaw, New York, Sydney, Dubai, and more, Fresha offers a truly international work environment. The workforce spans 41 countries.
- **Culture**: The company describes itself as "dynamic, disruptive," and focused on getting things done. Values include empathy, imagination, creativity, and commitment.
- **Engineering & Product Focus**: Strong technical teams (138 people in technical roles) working on a world-class product. The CTO and VP of Architecture & Data Engineering are active leaders.
- **Work Policy**: Hybrid/office presence expected at major hubs (London, Warsaw, etc.), with remote flexibility in certain roles. 114 open positions as of the latest data.
- **Employee Sentiment**: Mixed (3.1/5.0 on employer rating). Culture (3.0) and career growth (3.3) are rated slightly higher than work-life balance (2.9), indicating a fast-paced environment.

## Sources
1. [LinkedIn - Fresha Company Page](https://www.linkedin.com/company/heyfresha)
2. [Fresha Careers Page](https://www.fresha.com/careers)
3. [Fresha Official Website](https://www.fresha.com/en-GB)
4. [CB Insights - Fresha Profile](https://www.cbinsights.com/company/shedul)
5. [Fresha Open Positions](https://www.fresha.com/careers/openings)

## Other roles at Fresha

- [Business Development Manager (Manila)](https://feeny.ai/job/business-development-manager-manila-fresha-manila-089g707n6mjg) — Manila, Philippines
- [Business Development Manager (Istanbul)](https://feeny.ai/job/business-development-manager-istanbul-fresha-istanbul-ph3h39j8904s) — Istanbul, Turkey
- [Customer Success Manager (San Diego)](https://feeny.ai/job/customer-success-manager-san-diego-fresha-san-diego-4mrgrcbxvvq5) — San Diego, CA
- [Customer Success Manager (Vancouver)](https://feeny.ai/job/customer-success-manager-vancouver-fresha-vancouver-djjw3hb0trdw) — Vancouver, Canada
- [Associate Account Manager (San Diego)](https://feeny.ai/job/associate-account-manager-san-diego-fresha-san-diego-wh8mdj66d07e) — San Diego, CA
- [Onboarding Account Manager (Vancouver)](https://feeny.ai/job/onboarding-account-manager-vancouver-fresha-vancouver-2x5gfpddeq28) — Vancouver, Canada
- [Team Lead (Engineering)](https://feeny.ai/job/team-lead-engineering-fresha-london-1s1vtmbgrnf4) — London, United Kingdom
- [Associate Account Manager (Portuguese Speaking)](https://feeny.ai/job/associate-account-manager-portuguese-speaking-fresha-madrid-ejkv2anwtzma) — Madrid, Spain
- [Business Development Executive (Athens)](https://feeny.ai/job/business-development-executive-athens-fresha-athens-355r9krad5y8) — Athens, Greece
- [Overnight Onboarding Specialist (Shift Work)](https://feeny.ai/job/overnight-onboarding-specialist-shift-work-fresha-pristina-0tg5s7bvfhhm) — Pristina, Kosovo