Head of Product

We are recruiting on behalf of a client building a payment orchestration platform within an established group. The platform sits between merchants and the payment ecosystem. One integration for the merchant. Behind it, multiple providers, with each transaction routed on cost, likelihood of success and availability. The business is pre-launch. The architecture is being defined now. It is being built to PCI DSS Level 1 service provider requirements, and designed from day one for DORA — as an ICT third-party service provider to financial entities — and for the EU AI Act. The Role You own product development and delivery for the platform. Your mandate is simple to state and hard to do: define what gets built, sequence it correctly, and land the platform in production at PCI DSS Level 1. That certification is not a compliance afterthought running in parallel to the build. It is the delivery target. Every architectural and product decision either supports it or costs time the business does not have. This is a builder's role. In year one you write the specs yourself and work daily with the CTO and the engineering team. A product team grows under you once the platform is live and scaling. Scope boundary. Commercial negotiation, payment provider relationships and merchant sales sit with a separate role. You are not carrying a revenue target or a partner pipeline. You own what gets built, when it ships, and whether it passes audit. Our client is looking for a strong platform product leader. Payments is a complex domain and prior experience in it is a real advantage — but they would rather hire an excellent product mind who can get deep fast than an average one who already knows the acronyms. The domain expertise exists in house to bring you up to speed. What cannot be supplied is judgement. What You Will Own Product definition. The written specification of what the platform is and what it does. Requirements, user stories, acceptance criteria, edge cases. The single source engineering builds from. The routing engine. This is the product. The rules that decide where each transaction goes, what happens when it fails, when to retry, and when additional customer authentication is worth the friction it costs. Delivery. The roadmap, the sequencing, the release plan. Dependencies identified before they bite. Scope cut when the date matters more than the feature, and defended when it does not. PCI DSS Level 1 as a delivery programme. Cardholder data environment scope defined and held. Evidence, documentation and control ownership tracked as work items, not as a scramble before the assessment. Engineering, Compliance and the external QSA working from one plan — yours. Merchant-facing product surfaces. Onboarding and verification flows, sandbox and go-live, dashboard, reporting, reconciliation, dispute handling. The API as a product. Developer experience, reference documentation, versioning policy, SDKs, webhook design. The buyers are engineers. The integration is the sales pitch. Compliance by design. Working with Legal & Compliance so that PCI scope, DORA resilience obligations and AI Act classification shape the architecture up front, instead of being retrofitted before an audit. AI-enabled capability. Risk scoring, transaction monitoring, operational automation — specified with the regulatory obligations understood, and with sensitive data kept out of scope. What You Need Essential 5+ years in product management, with a track record of owning a product, not a feature set. Shipped API-first platform or infrastructure products. Not consumer apps. You understand that the developer is the customer. Zero-to-one experience. You have taken something from nothing to live, in production, with real users — and you can describe what broke. Delivered against a hard external deadline — an audit, a certification, a regulatory date — where slipping was not an option and the scope had to bend instead. Technical fluency. You can hold your own in a design discussion with a CTO. You do not need to write the code. You do need to understand the trade-off being made and challenge it. Strong written specification skills. Your documents are precise enough that engineers do not have to guess. Experience in a technically complex domain — payments, fintech, infrastructure, marketplaces, logistics, adtech or similar — where the hard part was the system, not the interface. Experience in a regulated or compliance-heavy environment, where security, audit or certification requirements shaped the design. Proven speed of learning. You can point to a domain you knew nothing about and became credible in within months. Comfortable making decisions with incomplete data, and equally comfortable changing them when evidence arrives. Fluent English, written and spoken. Greek is not required. Right to work in the EU, or eligible for Cyprus work authorisation, and willing to be based in Limassol. Strong advantage Direct payments experience — at a PSP, acquirer, gateway, orchestrator, or a company running its own payment stack. Familiarity with the card flow: authorisation, capture, refunds, settlement, reconciliation, chargebacks. Knowledge of 3DS and SCA, PSD2 exemptions, tokenisation, or scheme mandates. Prior involvement in a PCI DSS assessment, ISO 27001 certification, or SOC 2 audit — from the delivery side, not the advisory side. Multi-provider routing or authorisation-rate optimisation with a measurable uplift you can quantify. Applied ML in fraud, risk scoring, or operational automation. Experience with a scope-reduction architecture — tokenisation, hosted fields, or an external vault. What This Role Is Not Not a commercial role. Partner and merchant relationships are owned elsewhere. Not a delivery-administration role either. You are not tracking someone else's plan. You are writing it. Not a role where the domain stays at surface level. You do not need to arrive an expert. You do need to become one. Not a finished company. Scope will move. You will make calls with incomplete information and own the outcome.