Requirements

Bachelor's degree in computer science, Information Security, Cybersecurity, or related STEM field.
8+ years of experience in GRC, information security compliance, or technology audit in fintech, banking, payments, or regulated environments with EU/UK exposure.
Hands-on experience with controls related to DORA, EU AI Act, NIS2, PSD2/PSR, or UK PRA/FCA operational resilience.
Familiarity with EU/UK data privacy regulations such as EU GDPR, UK GDPR, and UK Data Protection Act 2018 for collaboration with Privacy teams.
Experience with Compliance-as-Code and GRC automation tools (e.g., Vanta), focused on continuous monitoring and reducing manual evidence collection.
Technical fluency in engineering, on-premises, hybrid, or cloud environments (AWS/GCP/Azure), and security architecture.

Nice to Haves

10+ years of experience in information security compliance or GRC engineering with an EU/UK focus in fintech or financial services.
Hands-on implementation of technical controls like IAM, logging, encryption, network segmentation, and integrating compliance into CI/CD pipelines.
Experience with ISO 27001 and SOC 2 alongside EU/UK regulatory compliance.
Understanding of GDPR security concepts and collaboration with DPO/Legal/Privacy.
Familiarity with DORA ICT third-party risk, threat-led penetration testing (TLPT), and major ICT incident reporting.
Experience with AI governance under the EU AI Act and security controls for AI in regulated financial products.
Knowledge of related regional regulations such as ePrivacy, Digital Services Act, MiCA, and FCA Consumer Duty technology implications.
Experience supporting enterprise sales with trust centers, vendor questionnaires, and security reviews for EU/UK buyers.
Ability to operate risk registers and make nuanced judgments focusing on outcomes.
Strong analytical, problem-solving, organizational, and project management skills.
Excellent communication and stakeholder management across engineering, legal, privacy, sales, and executives.
Certifications like CISSP, CISA, CISM, CRISC, ISO 27001 Lead Implementer/Auditor are a plus.
Prior experience in EU/UK-regulated financial institutions, EMI/PI environments, or supervised fintechs.

Own and develop EU/UK financial services and digital operational resilience posture across DORA and related regulations.
Build and maintain Compliance-as-Code capabilities including policy-as-code, automated control validation, and continuous evidence collection integrated into CI/CD.
Operate and enhance GRC platforms like Vanta, integrating with cloud, identity, logging, and engineering systems.
Partner with architects and engineering leads to embed EU/UK regulatory requirements into system design early.
Design, implement, and validate technical information security controls relevant to regulated EU/UK environments.
Manage cybersecurity and compliance risk registers, identifying and tracking meaningful business and regulatory risks.
Lead information security risk assessments and compliance reviews for new products, vendors, and architectural changes affecting EU/UK regulated areas.
Coordinate with the Data Privacy team on security-related intersections.
Build and maintain relationships with external auditors, assessors, and supervisors to ensure clear and relevant compliance communications.
Develop, maintain, and improve information security policies, standards, and procedures aligned with EU/UK regulations and standards.
Champion pragmatic governance focusing on real security and business risks over checkbox compliance.