Exchange and clearing-system supplier Vermiculus has appointed Alexander Kilian as chief information security officer, putting a named leader over work that includes governance, risk and compliance. Announced on 5 November, the role is directly relevant to market infrastructure because the company supplies software used in settings where the security of routing, position records and clearing operations has consequences beyond ordinary website availability.[1]
The announcement says Kilian was already active in client third-party risk management reviews, security requirements, AI governance and compliance matters. His new post formalises coordination of existing controls rather than announcing a completely new technology platform or certifying that all deployments are free of vulnerabilities. The company attributes to him more than 30 years of IT experience, with more than 25 in financial technology, and names involvement in work for Japan Exchange Group, ASX, London Metal Exchange and OCC.[1]
Evidence, status and operating implications
| Issue | Verified position |
|---|---|
| Supplier | VermiculusFT |
| Appointee | Alexander Kilian |
| Role | Chief Information Security Officer |
| Announcement | 5 November 2026 |
| Stated work | Governance, risk, compliance, third-party reviews and AI governance |
| Named customer project context | JPX, ASX, LME and OCC |
| Limit | No fresh independent security audit or service-level results announced |
Why one security function matters to multiple market operators
A critical market-infrastructure supplier faces overlapping questions from clients: what software version they run, who can access production, which subcontractors handle sensitive data, how security changes are tested, and how quickly an incident is reported. A chief information security officer can standardise policies and evidence across contracts, but the appointment alone does not tell us that every exchange has adopted identical controls or that the same architecture runs in each customer environment.[1]
Third-party risk is especially important for brokers whose services depend on exchange and clearing platforms outside their direct control. A software vendor may pass an onboarding questionnaire yet experience future outages or vulnerabilities. Participants therefore still need contract-specific uptime information, disaster-recovery evidence, material dependency mapping and tested incident escalation routes. There is no basis in this press release for claiming measured latency improvements, a new penetration-test result or a regulator-issued security rating.[1]
The appointment is a governance development at the technology-supply layer, with a clear reporting question for later coverage: whether the company publishes independent certifications, customer-specific resilience results or product-security milestones. For now, Vermiculus has identified a responsible leader and outlined the areas under his remit. That matters without being misrepresented as a completed technical audit.[1]
Sources & further reading
- Vermiculus appoints Alexander Kilian as Chief Information Security Officer VermiculusFT via Cision · 5 Nov 2026 · Accessed 7 Nov 2026