Information Security Officer

• Maintain the ISMS and ICT risk management framework records, including the document and records register, control ownership and evidence repository
• Perform and refresh information security risk assessments, maintain the risk register, prepare risk treatment plans and track implementation
• Prepare for and complete internal and external audits, certifications and assessments; manage the calendar, collect evidence, work with auditors and track findings to closure
• Check control design and operating effectiveness and raise remediation gaps
• Draft and maintain information security policies, procedures and guidelines for annual review and approval
• Collect and analyse ISMS KPIs and KRIs and prepare regular security and risk reporting for management
• Perform security assessments of new suppliers and periodic reassessments with Risk, Legal and the DPO
• Prepare responses to security and compliance questionnaires from partners, customers and regulators
• Review new projects, products and vendors from an information security and compliance perspective
• Track cybersecurity, ICT risk and privacy regulation and supervisory guidance changes, assess impact and propose changes
• Keep company-wide security awareness and training materials current
• Automate evidence collection, control checks, questionnaire answering and reporting with templates, scripts and AI tooling
• Report directly to the CISO and collaborate with Cyber Security, Engineering, Risk, Legal & Compliance, Internal Audit and other teams

• 4+ years of experience in information security compliance, ISMS, GRC or related areas
• Practical experience with ISO/IEC 27001, including working with an ISMS and preparing for and completing certification or surveillance audits
• Experience with information security risk assessments, risk registers and risk treatment plans
• Experience answering security questionnaires and due diligence requests from partners, customers or regulators
• Ability to translate standards and regulatory requirements into practical controls, procedures and evidence
• Hands-on and self-driven approach; ability to own tasks end to end
• Openness to AI tools and automation and active day-to-day use of them
• Strong written English and clear documentation skills
• Experience in banking, payments or an EMI
• PCI DSS, SWIFT CSP or payment scheme assessments
• Knowledge of DORA, NIS2 and GDPR, including working with a DPO on RoPA and DPIA
• Vendor security assessment and third-party risk experience
• Certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC or CISM

• Continuous personal and professional development resources and opportunities
• Flexibility to travel and work remotely or in a hybrid model across Europe
• Stock Options Program available to every team member
• Modern, friendly, and eco-conscious corporate culture
• Constant support and care
• Work & Swim Program: one month in a corporate apartment in Cyprus