Information Security Officer

• Maintain the ISMS and ICT risk management framework records, including the document and records register, control ownership, and evidence repository
• Perform and refresh information security risk assessments
• Maintain the risk register and prepare risk treatment plans
• Track implementation of risk treatments with control owners
• Prepare for and manage internal and external audits, certifications, and assessments
• Own the audit calendar, collect evidence, work with auditors, and track findings to closure
• Check control design and operating effectiveness and raise remediation gaps
• Draft, maintain, and prepare information security policies, procedures, and guidelines for review and approval
• Collect and analyse ISMS KPIs and KRIs and prepare security and risk reporting for management
• Perform security assessments of new suppliers and reassess existing suppliers with Risk, Legal, and the DPO
• Prepare responses to security and compliance questionnaires from partners, customers, and regulators
• Review new projects, products, and vendors from an information security and compliance perspective
• Track cybersecurity, ICT risk, privacy regulation, and supervisory guidance changes and propose required updates
• Maintain company-wide security awareness and training materials
• Automate evidence collection, control checks, questionnaire responses, and reporting using templates, scripts, and AI tooling
• Report directly to the CISO and collaborate with Cyber Security, Engineering, Risk, Legal & Compliance, Internal Audit, and other teams

• 4+ years of experience in information security compliance, ISMS, GRC or related areas
• Practical experience with ISO/IEC 27001, including working with an ISMS and preparing for certification or surveillance audits
• Experience with information security risk assessments, risk registers, and risk treatment plans
• Experience answering security questionnaires and due diligence requests from partners, customers, or regulators
• Ability to translate standards and regulatory requirements into practical controls, procedures, and evidence
• Hands-on and self-driven approach, owning tasks end to end
• Openness to and active use of AI tools and automation
• Strong written English and clear documentation skills
• Experience in banking, payments, or an EMI is nice to have
• PCI DSS, SWIFT CSP, or payment scheme assessments are nice to have
• Knowledge of DORA, NIS2, and GDPR, including working with a DPO on RoPA and DPIA, is nice to have
• Vendor security assessment and third-party risk experience is nice to have
• Certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC, or CISM are nice to have

• Continuous personal and professional development opportunities
• Remote or hybrid work flexibility across Europe
• Stock Options Program for every team member
• Supportive, modern, friendly, and eco-conscious corporate culture
• Work & Swim Program: one month in a corporate apartment in Cyprus