security officer in fintech

Finom is a European tech startup that provides an all-in-one financial B2B platform integrating banking, accounting, financial management, and invoicing. Its platform includes AI-enabled accounting and serves entrepreneurs across European markets.

• Maintain ISMS and ICT risk management framework records, including the document and records register, control ownership, and evidence repository
• Perform and refresh information security risk assessments, maintain the risk register, prepare risk treatment plans, and track their implementation with control owners
• Prepare for and manage internal and external audits, certifications, and assessments; own the calendar, collect evidence, work with auditors, and track findings to closure
• Check control design and operating effectiveness periodically and raise gaps for remediation
• Draft and maintain information security policies, procedures, and guidelines, and prepare them for annual review and approval
• Collect and analyse ISMS KPIs and KRIs and prepare regular security and risk reports for management
• Assess new suppliers and periodically reassess existing ones with Risk, Legal, and the DPO
• Prepare responses to security and compliance questionnaires from partners, customers, and regulators
• Review new projects, products, and vendors for information security and compliance
• Track changes in cybersecurity, ICT risk, and privacy regulation and supervisory guidance, assess their impact, and propose required changes
• Keep company-wide security awareness and training materials relevant and up to date
• Automate evidence collection, control checks, questionnaire responses, and reporting using templates, scripts, and AI tools

• 4+ Years of experience in information security compliance, ISMS, GRC, or related areas
• Practical experience working with an ISMS based on ISO/IEC 27001 and preparing for and completing certification or surveillance audits
• Experience with information security risk assessments, risk registers, and risk treatment plans
• Experience answering security questionnaires and due diligence requests from partners, customers, or regulators
• Ability to translate standards and regulatory requirements into practical controls, procedures, and evidence that people follow
• A hands-on, self-driven approach; ability to own tasks end to end and work directly with people to solve problems
• Openness to AI tools and automation and active use of them in day-to-day work
• Strong written English and clear documentation skills
• Будет плюсом: experience in banking, payments, or an EMI; PCI DSS, SWIFT CSP, or payment scheme assessments; knowledge of DORA, NIS2, and GDPR, including working with a DPO on RoPA and DPIA; vendor security assessment and third-party risk experience; ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC, or CISM certifications

• Stock Options Program available to every team member
• Opportunities for continuous personal and professional development
• Work & Swim Program: one month in a corporate apartment in Cyprus