🕒 6 days ago
Own day-to-day information security compliance and risk management by maintaining the ISMS, coordinating audits and assessments, improving controls, and translating regulatory requirements into practical processes.
Information Security Officer
🕒 6 days ago
Information Security ComplianceISMSGRCISO/IEC 27001
📜 Description
- Maintain ISMS and ICT risk management records, control ownership, and evidence repositories.
- Conduct security risk assessments, maintain the risk register, and track risk treatment plans with control owners.
- Coordinate internal and external audits, certifications, and assessments; manage evidence, auditor requests, and findings through closure.
- Review control effectiveness, maintain security policies and training materials, and report ISMS KPIs and KRIs to management.
- Assess suppliers, projects, products, and vendors; prepare security questionnaire responses and monitor regulatory changes.
- Automate evidence collection, control checks, questionnaire responses, and reporting using templates, scripts, and AI tools.
🛠️ Requirements
- 4+ years of experience in information security compliance, ISMS, GRC, or a related area.
- Practical ISO/IEC 27001 experience, including working with an ISMS and supporting certification or surveillance audits.
- Experience with information security risk assessments, risk registers, and risk treatment plans.
- Experience responding to security questionnaires and due diligence requests.
- Ability to translate standards and regulations into practical controls, procedures, and evidence.
- Self-driven, hands-on approach with end-to-end ownership; actively uses AI tools and automation.
- Strong written English and documentation skills.
- Nice to have: banking, payments, or EMI experience; PCI DSS or SWIFT CSP assessments; DORA, NIS2, or GDPR knowledge; vendor risk experience; or relevant certifications.
✨ Benefits
- Opportunities for personal and professional development.
- Stock options program available to team members.
- Supportive, eco-conscious corporate culture.
- Work & Swim Program offering one month in a corporate apartment in Cyprus.
Full job description
About Finom
Finom is a European tech startup headquartered in Amsterdam, and we’re on a journey towards revolutionizing the financial landscape for entrepreneurs worldwide. Our mission is to develop an all-in-one financial B2B solution that integrates banking functions, accounting, financial management, and invoicing into a seamless, mobile-first platform.
We recently closed a €115 million Series C equity round (around $133 million), bringing our total funding to approximately $346 million. This significant investment follows a $105 million growth funding round from General Catalyst, a long-term backer since 2021 known for supporting companies like Airbnb, HubSpot, KAYAK, and Stripe.
Finom's platform goes beyond traditional banking, offering invoicing and a growing suite of features, including AI-enabled accounting, aiming to simplify financial management for entrepreneurs. We're actively expanding our reach across key EU markets like Germany, France, the Netherlands, Italy, and Spain.
At Finom, we’re not just redefining the entrepreneurial experience — we’re empowering our employees to make a real difference. Your work matters, and your impact extends far beyond product metrics. We nurture innovation and an inspiring work environment where bold ideas thrive, prioritizing thorough research, swift implementation of solutions, and ensuring that every effort we make benefits our users, employees, partners, and our business as a whole.
Maintaining our start-up spirit, we prioritize thorough research, swift implementation of solutions, and ensuring that every effort we make benefits our users, employees, partners, and, of course, our business.
About the role
Finom is a licensed EMI operating across several EU markets, where information security and compliance are a big part of how we work. We're looking for an Information Security Officer to join our Cyber Security team and take ownership of security compliance and risk management day to day.
You won't be starting from a blank page. We already have a mature, certified ISMS and established processes for risk management, audits, vendor assessments and reporting. Your role is to get to know what we have, keep it running well, spot opportunities to make it better and make sure compliance works in practice, not just on paper.
You'll report directly to the CISO and work closely with our Cyber Security and Engineering teams, as well as Risk, Legal & Compliance, Internal Audit and other teams across the company.
What You Will Be Doing
- Maintain the ISMS and ICT risk management framework records: document and records register, control ownership and evidence repository.
- Perform and refresh information security risk assessments, maintain the risk register, prepare risk treatment plans and track their implementation with control owners.
- Prepare for and go through internal and external audits, certifications and assessments: own the calendar, collect evidence, work directly with auditors and track findings to closure.
- Run periodic checks of control design and operating effectiveness and raise gaps for remediation.
- Draft and maintain information security policies, procedures and guidelines and prepare them for annual review and approval.
- Collect and analyse ISMS KPIs and KRIs and prepare the regular security and risk reporting for management.
- Perform security assessments of new suppliers and periodic reassessments of existing ones together with Risk, Legal and the DPO.
- Prepare responses to security and compliance questionnaires from partners, customers and regulators.
- Review new projects, products and vendors from an information security and compliance perspective.
- Track changes in cybersecurity, ICT risk and privacy regulation and supervisory guidance, assess impact and propose required changes.
- Keep company-wide security awareness and training materials relevant and up to date.
- Automate evidence collection, control checks, questionnaire answering and reporting with templates, scripts and AI tooling.
- Perform and refresh information security risk assessments, maintain the risk register, prepare risk treatment plans and track their implementation with control owners.
- Prepare for and go through internal and external audits, certifications and assessments: own the calendar, collect evidence, work directly with auditors and track findings to closure.
- Run periodic checks of control design and operating effectiveness and raise gaps for remediation.
- Draft and maintain information security policies, procedures and guidelines and prepare them for annual review and approval.
- Collect and analyse ISMS KPIs and KRIs and prepare the regular security and risk reporting for management.
- Perform security assessments of new suppliers and periodic reassessments of existing ones together with Risk, Legal and the DPO.
- Prepare responses to security and compliance questionnaires from partners, customers and regulators.
- Review new projects, products and vendors from an information security and compliance perspective.
- Track changes in cybersecurity, ICT risk and privacy regulation and supervisory guidance, assess impact and propose required changes.
- Keep company-wide security awareness and training materials relevant and up to date.
- Automate evidence collection, control checks, questionnaire answering and reporting with templates, scripts and AI tooling.
Who You Are
- 4+ years of experience in information security compliance, ISMS, GRC or related areas.
- Practical experience with ISO/IEC 27001: working with an ISMS and preparing for and going through certification or surveillance audits.
- Experience with information security risk assessments, risk registers and risk treatment plans.
- Experience answering security questionnaires and due diligence requests from partners, customers or regulators.
- Able to translate standards and regulatory requirements into practical controls, procedures and evidence that people actually follow.
- Hands-on and self-driven: you own tasks end to end, work directly with people to solve problems and do not wait for a perfect methodology before acting.
- Open to AI tools and automation and actively use them in day-to-day work.
- Strong written English and clear documentation skills.
- Practical experience with ISO/IEC 27001: working with an ISMS and preparing for and going through certification or surveillance audits.
- Experience with information security risk assessments, risk registers and risk treatment plans.
- Experience answering security questionnaires and due diligence requests from partners, customers or regulators.
- Able to translate standards and regulatory requirements into practical controls, procedures and evidence that people actually follow.
- Hands-on and self-driven: you own tasks end to end, work directly with people to solve problems and do not wait for a perfect methodology before acting.
- Open to AI tools and automation and actively use them in day-to-day work.
- Strong written English and clear documentation skills.
Nice to Have
- Experience in banking, payments or an EMI.
- PCI DSS, SWIFT CSP or payment scheme assessments.
- Knowledge of DORA, NIS2 and GDPR, including working with a DPO on RoPA and DPIA.
- Vendor security assessment and third-party risk experience.
- Certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC or CISM.
- PCI DSS, SWIFT CSP or payment scheme assessments.
- Knowledge of DORA, NIS2 and GDPR, including working with a DPO on RoPA and DPIA.
- Vendor security assessment and third-party risk experience.
- Certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC or CISM.
Similar jobs
Search more Compliance Specialist jobs
Analista de Governança e Controles de Segurança da Informação
🕒 4 days ago
ALGAR👥 1001 - 5000 employees🏢 Telecommunications
🕒 4 days ago
Analisa e evolui a governança dos controles de Segurança da Informação, acompanhando certificações ISO 27001, CIS Controls, maturidade, riscos, evidências e planos de ação em parceria com áreas internas.
🕒 5 days ago
Provides second-line oversight of technology and cybersecurity risks by assessing exposures, challenging changes, monitoring controls and incidents, and partnering with global teams to strengthen risk governance.
🕒 6 days ago
Own day-to-day information security compliance and risk management by maintaining the ISMS, coordinating audits and assessments, and turning regulatory requirements into practical controls across teams.
CMMC Compliance Analyst
🕒 2 days ago
Sentinel Blue👥 11 - 50 employees🏢 Information Technology And Services
🕒 2 days ago
Support client CMMC and NIST compliance engagements by reviewing evidence and technical configurations, maintaining audit-readiness documentation, identifying gaps, and communicating clear remediation guidance.