Cyprus
Remote
Senior
Full Time
Information Security OfficerCyber SecurityISMSRisk ManagementISO/IEC 27001ComplianceSecurity AuditsRemote WorkStock Options
Requirements
- •4+ years of experience in information security compliance, ISMS, GRC or related areas
- •Practical experience with ISO/IEC 27001: working with an ISMS and preparing for and going through certification or surveillance audits
- •Experience with information security risk assessments, risk registers and risk treatment plans
- •Experience answering security questionnaires and due diligence requests from partners, customers or regulators
- •Able to translate standards and regulatory requirements into practical controls, procedures and evidence that people actually follow
- •Hands-on and self-driven: you own tasks end to end, work directly with people to solve problems and do not wait for a perfect methodology before acting
- •Open to AI tools and automation and actively use them in day-to-day work
- •Strong written English and clear documentation skills
What You'll Do
- •Maintain the ISMS and ICT risk management framework records: document and records register, control ownership and evidence repository
- •Perform and refresh information security risk assessments, maintain the risk register, prepare risk treatment plans and track their implementation with control owners
- •Prepare for and go through internal and external audits, certifications and assessments: own the calendar, collect evidence, work directly with auditors and track findings to closure
- •Run periodic checks of control design and operating effectiveness and raise gaps for remediation
- •Draft and maintain information security policies, procedures and guidelines and prepare them for annual review and approval
- •Collect and analyse ISMS KPIs and KRIs and prepare the regular security and risk reporting for management
- •Perform security assessments of new suppliers and periodic reassessments of existing ones together with Risk, Legal and the DPO
- •Prepare responses to security and compliance questionnaires from partners, customers and regulators
- •Review new projects, products and vendors from an information security and compliance perspective
- •Track changes in cybersecurity, ICT risk and privacy regulation and supervisory guidance, assess impact and propose required changes
- •Keep company-wide security awareness and training materials relevant and up to date
- •Automate evidence collection, control checks, questionnaire answering and reporting with templates, scripts and AI tooling
Nice to Have
- •Experience in banking, payments or an EMI
- •PCI DSS, SWIFT CSP or payment scheme assessments
- •Knowledge of DORA, NIS2 and GDPR, including working with a DPO on RoPA and DPIA
- •Vendor security assessment and third-party risk experience
- •Certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC or CISM
Benefits
- •Make a genuine impact on the product
- •Join our upward trajectory, and grow with us with resources and opportunities for continuous personal and professional development
- •Work in the EU with flexibility of traveling and working remotely or in a hybrid model across Europe
- •Become a stock options holder through Stock Options Program
- •Receive unwavering support and care in a modern, friendly, and eco-conscious corporate culture
- •Work & Swim program: spend one month in a comfortable corporate apartment in Cyprus to balance work-life with Mediterranean views
About Finom
Finom provides an online payment solution that integrates business accounts, invoicing, and accounting.
Amsterdam, Netherlands
500 - 1000
Finance