AI Governance & Information Security Lead

Fetch is how modern pet parents give their pets the best care 🐶🐱. One pink app 🩷 for insurance, health, and care – easy, fair, and kinda fun. We've raised our Series A from Lightspeed and Airtree, customers love us (rated #1 by Choice Magazine!), and we're growing fast.

Here’s the thing about AI: the power of it isn’t the hard part anymore. Capable models are everywhere, and everyone has the same access we do. Today’s frontier, the genuinely inspiring, impactful work, is how that capability gets deployed: the judgement, the controls, and the architecture that turn a raw model into something safe and trusted, and delivers new, compelling value into the pet ecosystem. That is the real opportunity at Fetch, and it’s the one we’re hiring for.

We run AI throughout our business, which means our security and our AI governance are the same conversation. We're looking for a passionate tech leader who can own both, and who wants to be at the forefront of how AI actually gets built and shipped here.

• Location: Sydney (Hybrid – Tue/Wed/Thu in-office)
• Compensation: Series A salary + meaningful equity upside
• Working with: Fetch Founders and Founding Team members, including the CEO and CTO. Reporting to Head of Legal, Risk & Compliance.

This isn’t a role that polices AI from the sidelines. You’ll sit at the front of creating how AI gets deployed at Fetch, owning AI governance and information security end-to-end, and shaping the capability itself: what we ship, how we ship it, and why anyone should trust it. You’ll collaborate with stakeholders across our team to make sure the AI we put into production is safe, defensible, and worth trusting. You’ll build the kind of groundbreaking capability that delights our customers, always:

• Lead Fetch’s AI governance and control systems across the business
• Lead Fetch's ISMS and security posture across the business
• Make sure every AI model and information system we run is monitored and auditable
• Work across the business to drive best practices implementation, including certification standards
• Turn regulatory and compliance obligations into operational competitive advantage that delivers results for a rapidly scaling start up
• Set the deployment bar for the business: the judgement and guardrails that decide what good looks like before anything goes live

This is a hands on, builder’s role and you will be building this into Fetch’s systems: engineering, architecture and implementation. The deliverables below aren’t a policy library. They’re the operating system for how Fetch deploys AI and tech well, at scale, for the long run:

• A unified InfoSec + AI governance operating model: One framework, one risk register, one set of controls
• An AI assurance program: Pre-deployment risk assessment, red-teaming, adversarial testing, evaluation loops, drift monitoring, and decommissioning triggers for every model
• Guardrails built into the system, not the policy doc: Secrets blocked before they ever deploy, powerful service-account access scoped and restricted by default, risk-register compliance enforced automatically, and security pushed down to the code level, because a control only counts if it fires without anyone remembering to run it
• Third-party InfoSec and AI risk discipline: Real diligence on the models and vendor stacks
• Incident response readiness: Support resiliency and business continuity across relevant scenarios
• Security tooling that closes the loop: Incident logging wired straight into Notion and Slack, security events summarised automatically rather than by hand, and monitoring seamlessly across systems for a single view, because you can't respond to what you can't see
• Resource allocation planning: You'll identify and deploy resources efficiently to deliver outcomes aligned with Fetch's strategy and scale-up ambitions

You're a collaborative, curious, tech practitioner, the kind of lead who is genuinely excited by the actual deployment frontier, not just the model demo. You measure your success in capability shipped and impact sustained. You deliver controls that are genuinely load-bearing, not just ticking boxes:

• 5+ years in the information security space, with a track record of positive impact
• Genuine tech capability – not "I've read the theory," but "I've stood up a framework, classified models and systems by risk, and defended the decisions"
• Pragmatic, outcomes-driven, builder – you can write the policy, but you'd rather ship the control
• Clear communicator – you can brief the board on Tuesday and collaborate with a frontline operations teammate on Wednesday
• Bonus – experience with ISO 27001 and/or ISO 42001 implementation
• Bonus - you've done this in regulated environments (financial services, insurance, health, or similarly scrutinised)

We're ambitious, collaborative, and genuinely enjoy building together. The Fetch team is smart, thoughtful, and kind – low ego, open, caring, and always supportive.

• You'll be involved early in strategy. You're encouraged to give your opinion and debate with founders and the rest of the team
• Weird is welcome. We value unexpected perspectives and people who think differently, so just be you
• Unlimited AI tooling - no token limits or approvals needed. Just try things (responsibly – you'll be the one architecting the policy on it)
• Work on a product genuinely loved by tens and tens of thousands of pets, pet parents and vets
• We're growing FAST. It's an exciting time to join and you'll directly impact the future of our products
• We say "steward" not "owner" – the accountability is real, the language signals how we hold it

• Competitive Series A salary + meaningful equity
• Hybrid working (3 days Sydney office, flexible WFH)
• Latest MacBook Pro and a top setup
• Two team retreats each year
• Office dogs for cuddles and interruptions
• Bean to cup coffee machine, unlimited fruit and snacks. Toblerone on-tap

Apply via the link, along with a quick note highlighting (bonus points if you include a photo of your pet 🐾):

• Where you think the boundary between AI governance and InfoSec is genuinely shared, and where they need to be held distinct
• What excites you most about working at Fetch