Spain
Remote
Mid Level
Full Time
Information SecurityISMSCyber SecurityRisk ManagementISO/IEC 27001ComplianceGRCAI toolsRemote WorkStock Options
Requirements
- •4+ years of experience in information security compliance, ISMS, GRC or related areas
- •Practical experience with ISO/IEC 27001 including working with an ISMS and preparing for and going through certification or surveillance audits
- •Experience with information security risk assessments, risk registers and risk treatment plans
- •Experience answering security questionnaires and due diligence requests from partners, customers or regulators
- •Ability to translate standards and regulatory requirements into practical controls, procedures and evidence that people actually follow
- •Hands-on and self-driven approach, owning tasks end to end and working directly with people to solve problems
- •Open to AI tools and automation and actively use them in day-to-day work
- •Strong written English and clear documentation skills
What You'll Do
- •Maintain the ISMS and ICT risk management framework records including document and records register, control ownership and evidence repository
- •Perform and refresh information security risk assessments, maintain the risk register, prepare risk treatment plans and track their implementation with control owners
- •Prepare for and go through internal and external audits, certifications and assessments, own the calendar, collect evidence, work directly with auditors and track findings to closure
- •Run periodic checks of control design and operating effectiveness and raise gaps for remediation
- •Draft and maintain information security policies, procedures and guidelines and prepare them for annual review and approval
- •Collect and analyse ISMS KPIs and KRIs and prepare regular security and risk reporting for management
- •Perform security assessments of new suppliers and periodic reassessments of existing ones together with Risk, Legal and the DPO
- •Prepare responses to security and compliance questionnaires from partners, customers and regulators
- •Review new projects, products and vendors from an information security and compliance perspective
- •Track changes in cybersecurity, ICT risk and privacy regulation and supervisory guidance, assess impact and propose required changes
- •Keep company-wide security awareness and training materials relevant and up to date
- •Automate evidence collection, control checks, questionnaire answering and reporting with templates, scripts and AI tooling
Nice to Have
- •Experience in banking, payments or an EMI
- •PCI DSS, SWIFT CSP or payment scheme assessments
- •Knowledge of DORA, NIS2 and GDPR, including working with a DPO on RoPA and DPIA
- •Vendor security assessment and third-party risk experience
- •Certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC or CISM
Benefits
- •Make a genuine impact on the product
- •Join an upward trajectory with resources and opportunities for continuous personal and professional development
- •Work in the EU with flexibility of traveling and working remotely or in a hybrid model across Europe
- •Become a stock options holder through the Stock Options Program
- •Receive unwavering support and care in a modern, friendly, and eco-conscious corporate culture
- •Work & Swim program offering one month in a corporate apartment in Cyprus for work-life balance
About Finom
Finom provides an online payment solution that integrates business accounts, invoicing, and accounting.
Amsterdam, Netherlands
500 - 1000
Finance