Head of Information Security

Role overview Lead information security across a digital financial services environment as it prepares to operate under banking regulation. The role combines hands-on security engineering, regulatory risk oversight, and coordination with engineering, operations, IT, and compliance teams. You will contribute to product and architecture decisions early and take ownership of security issues, including incident response.

Responsibilities - Review system architecture and significant product changes with delivery teams, identifying security risks during design. - Work alongside engineers to improve secrets handling, access controls, network separation, logging, alerting, and CI/CD pipeline security. - Plan external penetration tests, red team exercises, and threat-led testing; turn findings into a prioritized remediation backlog. - Monitor the ICT risk management framework and coordinate its practical application with the relevant lines of defence. - Maintain clear records of assurance work, audits, results, and follow-up actions. - Translate assessment findings into prioritized business requirements and improvements to security processes.

Requirements - Experience applying financial-sector ICT rules and supervisory expectations, including DORA and central-bank or national regulator requirements. - Ability to read and write code and perform security hardening in cloud environments. - Practical familiarity with security tools such as code analysis, network analysis, and vulnerability scanning. - Experience with penetration testing methods and standards. - Ability to assess the benefits, risks, and governance implications of using LLM-enabled security tools in a regulated organization.

Benefits and work setup The role is preferably based in Estonia, with remote work possible from elsewhere in the EU. The source describes five weeks of vacation, private healthcare compensation, a hobby allowance, mental health support, share options, and a learning budget.