Security risk manager in crypto

EMCD is a leading technology company in the crypto industry, best known as the largest mining pool in Eastern Europe. We are expanding globally and building a comprehensive ecosystem of crypto services, including payment infrastructure, custody, mining solutions and enterprise-grade tools for businesses and institutions. We are looking for an Security Risk Manager to take ownership of our cyber risk management program, drive security audits and regulatory licensing initiatives.

• Conduct information security risk assessments of partners and vendors during onboarding: prepare reports, identify risks, and record risk treatment measures in the register.
• Maintain the IS risk register: escalate to risk owners, track and control the implementation of risk treatment plans.
• Risk communication: lead risk syncs and provide risk updates for C-level executives.
• SOC 2: coordinate projects and manage the IS track of the initiative, including risk assessment (CC3) and preparation for Type 2.
• Regulatory licensing (VASP): lead the IS portion of applications, perform initial cyber risk assessments, develop cyber risk management policies and procedures, and respond to regulator inquiries.
• Lead the Governance & Compliance team (2 people): planning, workload allocation, and team KPIs.

• 4+ years of experience in Information Security Risk Management or GRC, with a significant background in fintech, crypto, or another regulated environment.
• Experience maintaining a risk register and working directly with business risk owners: assessment, treatment plans, execution control.
• Practical experience in Third-Party Risk Management (TPRM).
• Knowledge of ISO 27001/27005, NIST CSF, or SP 800-30; understanding of qualitative and quantitative risk assessment methods.
• Experience preparing for SOC 2 or ISO 27001: controls, evidence collection, and auditor engagement.
• Experience working with regulatory requirements for IS (VASP, MiCA, DORA, or equivalents).
• Understanding of crypto infrastructure (custody, wallets, keys, HSM) at a risk assessment level.
• Ability to prepare concise, data-driven materials with clear proposed solutions for C-level executives.
• Fluent Russian and English (C1): documentation, audit collaboration, and regulatory communication.

• Remote-first company — work from anywhere in the world.
• Fully flexible working hours.
• Extended time off: 20 paid vacation days + 12 bonus days per year.
• 100% paid sick leave.
• Paid English lessons (iTalki).
• Professional growth support (courses, certifications, training programs).
• Real impact and ownership in fintech & crypto projects.
• Corporate benefits: EMCD product discounts and mining infrastructure access.
• Employment via Service Agreement.