Information Security Officer

• Maintain the ISMS and ICT risk management framework records, including the document and records register, control ownership and evidence repository
• Perform and refresh information security risk assessments
• Maintain the risk register and prepare risk treatment plans
• Track implementation of risk treatment plans with control owners
• Prepare for and manage internal and external audits, certifications and assessments
• Own the audit calendar, collect evidence, work directly with auditors and track findings to closure
• Check control design and operating effectiveness and raise remediation gaps
• Draft and maintain information security policies, procedures and guidelines
• Prepare policies and guidelines for annual review and approval
• Collect and analyse ISMS KPIs and KRIs
• Prepare regular security and risk reporting for management
• Perform security assessments of new suppliers and periodic reassessments with Risk, Legal and the DPO
• Prepare responses to security and compliance questionnaires from partners, customers and regulators
• Review new projects, products and vendors for information security and compliance
• Track changes in cybersecurity, ICT risk and privacy regulations and supervisory guidance
• Maintain company-wide security awareness and training materials
• Automate evidence collection, control checks, questionnaire answering and reporting using templates, scripts and AI tooling
• Report directly to the CISO and collaborate with Cyber Security, Engineering, Risk, Legal & Compliance and Internal Audit teams

• 4+ years of experience in information security compliance, ISMS, GRC or related areas
• Practical experience with ISO/IEC 27001, including working with an ISMS and preparing for and completing certification or surveillance audits
• Experience with information security risk assessments, risk registers and risk treatment plans
• Experience answering security questionnaires and due diligence requests from partners, customers or regulators
• Ability to translate standards and regulatory requirements into practical controls, procedures and evidence
• Hands-on, self-driven approach with end-to-end task ownership
• Openness to and active use of AI tools and automation
• Strong written English and clear documentation skills
• Experience in banking, payments or an EMI
• PCI DSS, SWIFT CSP or payment scheme assessments
• Knowledge of DORA, NIS2 and GDPR, including working with a DPO on RoPA and DPIA
• Vendor security assessment and third-party risk experience
• Certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC or CISM

• Continuous personal and professional development opportunities
• Flexible travel and remote or hybrid work across Europe
• Stock Options Program available to every team member
• Ongoing support and care
• Work & Swim Program: one month in a corporate apartment in Cyprus
• Eco-conscious corporate culture