Information Security Engineer (CISO track)

Fully remote CET timezone or close - Full-time Reports to the CTO

About the role

Youll be our first dedicated information security hire. Right now security is a part-time job for engineering leadership and external vendor; we want it to be your full-time one. The work is hands-on: AWS infrastructure as code detection and response auditors. As the company grows the role grows into CISO.

We sell to financial institutions and their security teams question everything we do so youll be the person with good answers.

Tasks

What youll do

• Own security in our AWS environment: IAM and least privilege network segmentation encryption logging and detection (GuardDuty Security Hub CloudTrail) fixing what you find.
• Build security into the development pipeline: secrets management dependency and container scanning code review for risky changes threat modeling with the engineers.
• Automate. Detection rules alerting compliance evidence IaC guardrails. If a control can be code instead of a meeting make it code.
• Run vulnerability management and incident response. Write the runbooks run the drills.
• Set the rules for our AI and LLM use: which data goes to which vendors which models are approved how prompts and outputs are handled and logged. Assess risks like prompt injection and data leakage design controls that let people keep working.
• Own SOC 2: control design automated evidence collection the auditor relationship.
• Handle regulatory side for our financial-institution customers: GDPR and CCPA for privacy DORA and EBA outsourcing guidelines in the EU GLBA and SEC/FINRA expectations in the US.
• Lead customer security reviews: due diligence questionnaires RFPs contract security terms calls with bank security teams.
• Run vendor reviews and third-party risk.
• Secure the human half by building awareness training phishing resilience and device and identity hygiene that work for deals and sales people not only engineers.
• Over time: set the security strategy report risk to leadership in business terms choose tooling build a budget hire.

Requirements

What were looking for

• 5 years in security engineering or security-heavy infrastructure work with depth in AWS security (IAM SCPs logging detection encryption). Certifications are fine but shipped work is better.
• Python and Terraform or close equivalents. You automate evidence collection instead of maintaining spreadsheets.
• SOC 2 experience ideally owning a Type II audit. Working knowledge of privacy legislation.
• Exposure to financial-services customer scrutiny or the appetite to make it your specialty.
• A working view on LLM security risks or strong fundamentals and the curiosity to build one.
• Judgment about which risks matter. You can tell an auditor why a control exists and an engineer why it isnt theater.
• Clear writing. Remote means async and async means your policies and risk memos do the talking.
• The ambition to grow into an executive role and the people skills to survive it.

Nice to have

• Fintech or another regulated B2B environment with large financial-institution customers.
• DORA EBA/ESMA outsourcing guidelines or NYDFS 500.
• Experience securing enterprise integrations: SSO/SCIM SFTP feeds APIs.
• Youve been the first security hire somewhere before.

Benefits

What we offer

• A blank slate with real ownership
• A committed path to CISO.
• Fully remote flexible hours.
• Direct access to leadership and to customer security teams at major financial institutions.
• Competitive pay equity learning budget.

How we hire

1. Intro call (30 min).
2. Technical deep dive (6090 min): AWS security scenarios plus a walk-through of a program you built.
3. Practical exercise: review a sanitized architecture or a due diligence questionnaire and tell us what youd fix first.
4. Leadership conversation: the CISO path and working with the non-technical half of the company.
5. References and offer.

Were an equal opportunity employer. If you dont tick every box apply anyway.