Information Security Lead

Information Security Lead to strengthen Secfix's compliance function as it scales into more frameworks, mid-market customers, and a growing compliance team. You'll own the compliance knowledge inside the platform, manage compliance specialists, support the customer success team, and act as the senior compliance voice for customers, auditors, and product.

What you'll do

• Own and drive the compliance roadmap inside the Secfix platform across different compliance frameworks (ISO 27001, TISAX, SOC 2, GDPR, NIS 2, DORA, ISO 27017/27018, ISO 42001, C5, and more as we expand)
• Implement ISO 27001 and adjacent frameworks end-to-end for customers
• Hire, manage and upskill the compliance team: sharing expertise, reviewing work, and helping drive consistency in audits and customer deliverables
• Conduct internal audits directly for strategic and complex customers, and review the internal audits performed by team members to drive quality and consistency
• Act as a compliance partner to CSMs and sales reps: fast, reliable support for customer questions, and joining customer calls when deep expertise is needed
• Own the quality of compliance content in the platform (including creating policies, evidence templates, compliance-enabled playbooks for our CSMs, security awareness trainings and more)
• Partner with product and engineering to translate compliance gaps into structured product work
• Collaborate closely with CS, Product, and Founders to align compliance, customer, and roadmap priorities

What you'll need

• 7+ years of hands-on information security and GRC experience in B2B SaaS, including at least 2 years in an InfoSec leadership role
• Led 5+ successful ISO 27001 certification projects as an implementer and/or auditor at a startup or mid-market company
• Hands-on experience with a GRC platform like Secfix, or similar GRC platforms
• Cloud infrastructure readiness across AWS, Azure, and GCP; experience with posture analysis and remediation planning
• Strong project management skills with the ability to break down ambiguous initiatives into concrete deliverables, prioritise ruthlessly, and ship
• Excellent written communication, especially in producing clear, precise compliance content for diverse audiences (auditors, founders, engineers)
• Strong ownership mindset: operates as a senior individual contributor without waiting for direction
• Bachelor's degree in Computer Science, Information Technology, Software Engineering or a related field

Nice to have

• Experience implementing one or two additional compliance frameworks (e.g. SOC 2, GDPR, NIS 2, etc.)
• Experience in a startup environment

What they offer

• 100% remote work with a virtual office in Gather
• Industry-competitive local salaries at or above market rate
• Generous equity package
• €1,000 annual personal development budget
• 26 days holiday plus local public holidays
• Comprehensive health coverage