HRTech Interview with Jonathan Olson, CTO at O.C. Tanner

To start, can you share a bit about your role as Chief Technology Officer at O.C. Tanner and how your team’s work helps build trust with both clients and employees?

At O.C. Tanner, I am leading the teams that design, build, and support the technology behind our recognition and culture solutions. Our work centers on ensuring our platforms foster appreciation, belonging, while being secure and built for long term partnership.

For nearly a century, O.C. Tanner has helped organizations build thriving workplace cultures through our Culture Cloud platform, which leverages employee recognition to connect teams across departments and geographies. Our research shows that when employees are part of organizations with integrated recognition programs, they are 10 times more likely to trust their organization. We’re using technology to help power those programs for our clients and help them shape how employees experience recognition and community at scale.

HR leaders entrust us with highly sensitive employee data, including career milestones, recognition moments, peer feedback, and personal achievements, all of which represent meaningful experiences in people’s professional lives. Protecting that information is not simply a technical requirement, but a reflection of our responsibility to safeguard the trust placed in us by both clients and employees. Our platform operates with reliability, transparency, and strong governance so our clients will always know their data is safe and secure.

O.C. Tanner recently achieved ISO/IEC 27001:2022 certification. From your perspective as CTO, why is this milestone significant, not only for O.C. Tanner, but for HR and technology leaders navigating today’s risk landscape?

O.C. Tanner’s ISO 27001:2022 certification represents a comprehensive and externally validated information security management system. It requires structured risk assessment, formal governance, executive oversight, and continuous improvement rather than periodic reviews.

Recognition and culture platforms now sit within complex, integrated HR ecosystems and contain sensitive employee data. This certification proves our dedication to ensuring that security is embedded into Culture Cloud and managed proactively, so our clients feel confident knowing risk is monitored, assessed, and addressed immediately.

Since our platforms support integrated recognition programs that span the entire employee journey from onboarding to career milestones, the volume and sensitivity of data involved requires careful oversight. The ISO 27001 certification is third-party validation that we manage that responsibility with care and transparency.

HR teams are managing more sensitive employee data than ever across recognition, engagement, and culture platforms. What are the most critical data security risks you see organizations facing right now?

One risk we are seeing is when it comes to ecosystem complexity. HR platforms are interconnected across vendors, geographies, and internal systems, and every integration point increases potential exposure if it is not carefully governed. With regulatory complexity increasing, organizations must also comply with expanding privacy requirements across multiple jurisdictions, adding another layer of complexity and risk.

Secondarily, as AI becomes more sophisticated, so do cyber threats, which increasingly target identity information and employee data. It’s critical to have guardrails in place that all members of the organization follow to prevent cyber attacks, and equally critical to work with technology providers like O.C. Tanner that have strong security governance.

As organizations increasingly use recognition and engagement platforms to strengthen the workplace culture, the data within those systems becomes more meaningful and therefore more important to protect. Addressing these risks requires mature governance structures, clear accountability, and continuous monitoring rather than isolated technical controls.

ISO/IEC 27001 emphasizes continuous risk management and improvement. How does earning this certification reflect O.C. Tanner’s broader approach to responsibility, governance, and long-term partnership with clients?

Continuous improvement is central to how we operate across the organization. ISO 27001 formalizes processes for identifying emerging risks, implementing controls, evaluating effectiveness, and refining those controls over time.

This approach aligns with our broader commitment to stewardship and long-term partnership with our clients. They rely on us not only for technology but for stability and accountability. Our primary goal at O.C. Tanner is to help organizations create strong cultures built on trust and recognition, and we practice what we preach – including through our technology. Pursuing security certifications like ISO and SOC 3 continuously reinforces that trust between us and our clients so they can focus on driving revenue, nurturing talent, and strengthening belonging within their organizations.

Embedding governance into our systems reinforces that security is not static. It evolves alongside client needs and the changing risk environment. Our philosophy has always been centered on helping organizations build cultures that endure, and applying that same discipline and long term thinking to information security ensures that trust remains foundational to those efforts.

Security is often viewed as a purely technical concern. Why do you believe information security is increasingly foundational to employee trust and workplace culture, especially in HR technology?

Recognition platforms like Culture Cloud store sensitive information around personal milestones, peer anecdotes, or meaningful stories that are meant to positively shape how employees experience work. Even if recognition is a positive thing, employees want to know that what they tell their leaders or share through Culture Cloud is protected. Trust is hard to win but very easily shattered, and one of the fastest ways to do so is by a lack of concern around employee data. Confidence in how that information is handled directly influences recognition, participation, and engagement.

Our research consistently shows that a strong workplace community improves belonging, which often depends on trust. In digital environments, trust is often reinforced through responsible data management. When organizations demonstrate care in protecting employee information, they strengthen psychological safety and reinforce the integrity of their culture initiatives.

Security, in that sense, becomes a human issue. It supports the conditions that allow appreciation and connection to thrive.

This certification builds on O.C. Tanner’s existing SOC 3 designation. How do these frameworks complement each other, particularly for global organizations operating in highly regulated environments?

SOC 3 validates operational controls related to security and privacy, including confidentiality, availability, and integrity. ISO 27001 establishes the broader management framework that governs how those controls are assessed, maintained, and improved over time.

Together, these frameworks provide layered assurance of Culture Cloud’s safety within highly regulated environments. While one confirms that strong controls are in place, the other confirms that there is a disciplined system overseeing risk management and continuous improvement. For global organizations operating in regulated environments, that combination provides meaningful clarity and confidence.

From your vantage point, how does strong information security enable organizations to focus on what really matters – recognition, belonging, and employee experience – without compromising privacy or compliance?

When security frameworks are mature and well governed, they remove uncertainty and allow HR leaders to focus their attention on strengthening connection and community rather than worrying about compliance gaps.

Frequent and meaningful recognition that is embedded into culture drives stronger connection and performance outcomes, and those programs rely on secure, stable infrastructure to function effectively across organizations. Security creates the stability that enables culture initiatives to deliver lasting impact.

Looking ahead, how do you see expectations evolving around transparency, compliance, and data stewardship in HR technology over the next few years?

We are seeing expectations rising as employees want clearer understanding of how their data is used, regulators continue to strengthen privacy requirements, and boards place greater emphasis on governance and risk management.

Technology providers will need to demonstrate not only compliance but accountability through clear governance structures, transparent processes, and executive ownership of security. Organizations that align strong data management and protection with a people-centered culture will increasingly differentiate themselves as trustworthy partners.

What advice would you offer HR and people leaders who are evaluating technology partners and want confidence that their employee data is protected at the highest level?

Security maturity should be a central part of every evaluation process, and leaders should look beyond product features to understand independent certifications, formal risk management frameworks, governance structures, and incident response practices.

It is equally important to assess whether security is embedded into leadership culture, as the strongest partners treat it as a responsibility to employees and clients rather than solely as a regulatory requirement.

Finally, is there anything else you’d like to share with our readers about how trust, security, and culture will intersect in the future of work?

Work will continue to become more digital and interconnected, and recognition platforms will play an increasingly important role in shaping employee experience across global organizations.