Job Description

Responsibilities:

• Security Governance & Ownership


• Own the company’s information security governance framework aligned with MiCA and DORA requirements.
• Maintain security policies, standards, and procedures (ISMS, incident response, access control, key management oversight).
• Maintain the security risk register and ensure formal risk acceptance and escalation processes.


• Oversight & Control


• Design and oversee security controls across infrastructure, applications, cloud, and crypto-asset related systems.
• Provide independent security oversight of engineering, infrastructure, and outsourced vendors.
• Ensure segregation of duties between security governance and technical execution.


• Third-Party & Outsourcing Security


• Oversee security risks related to outsourced services and vendors.
• Define security requirements for vendors and ensure ongoing monitoring and assurance.
• Retain security accountability internally while execution may be outsourced.


• Incident Management & Readiness


• Own the security incident management framework, including detection, classification, escalation, and post-incident review.
• Coordinate incident response with internal teams, vendors, and external specialists.
• Ensure incident documentation and regulatory-ready evidence is maintained.


• Regulatory & Audit Interface


• Act as the primary security point of contact for regulators and auditors.
• Support licensing, regulatory reviews, and supervisory audits related to information security.
• Ensure timely preparation and availability of security documentation and evidence.


• Reporting & Escalation


• Provide regular security risk and posture reporting to senior management and the Board.
• Escalate material security risks and control deficiencies through formal channels.
• Maintain written records of risk decisions and management acknowledgements.


• Security Culture & Awareness


• Promote a security-first culture across the organization.
• Define and oversee security awareness and training programs.
• Ensure security considerations are embedded into business and technology decision-making.

Requirements:

• 2+ years in information security, including senior leadership roles (CISO / Head of Security or other similar level).
• Experience in regulated environments
• Practical exposure to regulatory audits and supervisory reviews.
• Strong understanding of EU security regulations (MiCA, DORA).
• Proven ability to operate security governance frameworks (policies, risk register, controls).
• Experience managing security risks for outsourced vendors and cloud providers.
• Hands-on involvement in security incident management and post-incident reviews.
• Strong communication skills, able to escalate and document risks to senior management and the Board.
• Process-driven mindset; comfortable documenting dissent and risk acceptance.