Senior Specialist, Information Security
Your mission
As an Information Security Senior Specialist, you will lead and scale major elements of our security governance in a regulated fintech environment. You’ll own complex, cross-functional GRC domains (e.g., ISMS/ISO 27001 at scale, regulatory readiness, enterprise technology risk, third-party risk for critical vendors, compliance in key partnerships), drive measurable improvement in control effectiveness, and act as a trusted advisor to senior stakeholders.
What you’ll do
Information Security Operating Model & GRC Ownership: Own and evolve one or more GRC domains end-to-end (e.g., ISMS operations, BCM, risk governance), including strategy, annual plan, cadences, and success metrics. Drive control rationalization and proportionality: tighten controls for critical/regulated assets and streamline low-risk areas to ensure an efficient, risk-aligned posture.
Risk Management & Strategic Decision Support: Facilitate and challenge high-impact risk assessments (new products, major architectural changes, critical vendors), ensuring consistency and defensible rationale. Drive risk treatment at scale: align owners, negotiate timelines, track commitments, and escalate where residual risk remains above appetite.
Audit, Assurance & Continuous Control Testing: Lead complex audits and assessments end-to-end (multi-entity, regulator-facing), including readiness, walkthroughs, and remediation. Design and run a risk-based control testing program to identify weaknesses and drive durable remediation (process fixes, automation, tooling) while translating regulatory requirements into structured internal work programs.
Third-Party Risk & Critical Supplier Oversight: Set due diligence depth and ongoing monitoring requirements for critical suppliers (e.g., cloud, payments, identity, SaaS); partner with Procurement/Legal on security contract requirements to ensure enforceable obligations and measurable oversight across the supply chain.
Enablement & Leadership through Others: Mentor Specialists, Associates, and Senior Associates; set quality standards for documentation, evidence, and stakeholder engagement. Act as a “GRC translator” for engineering and operations teams, helping them implement requirements efficiently and consistently across the organization.
Who you are
Typically 6–10 years of experience in information security GRC, audit/assurance, risk management, compliance, or adjacent security roles.
Proven track record leading audits/assessments and driving remediation across multiple teams and systems.
Strong working knowledge of ISO 27001 and DORA (and/or SOC 2 / PCI DSS / NIST) with ability to design controls, define evidence, and test effectiveness.
Strong understanding of technology risk across cloud, IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and third-party risk.
Excellent written and verbal communication; able to produce executive-ready materials and auditor-facing narratives.