Information Security Officer (ISO)

As Information Security Officer, you will own the information security program end-to-end to support rapid, safe growth. You will keep ISO 27001 ISMS healthy and audit-ready while driving practical security improvements across the company. You’ll influence Engineering leadership and collaborate with Platform, IT, Legal/Privacy, and Support to protect customers and the business. This role treats security as a business enabler and requires hands-on governance and cross-functional leadership. You’ll engage in architecture reviews as a security reviewer to catch implications early without slowing delivery.

• Salary - 70,000 gross annually
• 2,000 learning budget
• 28 days of paid vacation
• Sabbatical 4 weeks every 3 years
• Flexible hybrid model (3 days/week in office)
• Company gym

• Maintain and improve the ISO 27001 ISMS (audits, evidence, management reviews, corrective actions, external readiness)
• Lead security risk management with a living risk register and remediation timelines
• Develop practical security policies and standards for access, data handling, vendor risk, and incident response
• Lead security incident governance (classification, escalation, post-incident learning) in collaboration with Platform, Engineering, and Support
• Manage third-party and vendor security risk including due diligence and legal collaboration on security requirements
• Enable safe AI use with guardrails and visibility on shadow IT/AI in coordination with IT and Platform
• Report to leadership on security posture, risks, incidents, audits, and progress

• 3+ (typically 5+) years of relevant security experience with proven ISMS/audit cycle ownership (ISO 27001 or equivalent)
• Proven experience operating or contributing to an ISO 27001 ISMS, with audit readiness and remediation
• Strong written and verbal English communication; ability to translate security topics into clear actions
• Nice to have: SOC 2 readiness or similar assurance frameworks
• Nice to have: familiarity with AI governance and AI risk management or strong willingness to learn
• Nice to have: certifications (CISSP, CISM, CISA, Security+, ISO 27001 Lead Implementer/Auditor)
• Nice to have: experience with vendor security reviews, security questionnaires, and enterprise customer trust requirements

• pragmatic decision-making balancing security, speed, and customer impact
• hands-on ownership mindset
• ability to influence and drive follow-through with stakeholders at all levels
• ISO 27001 ISMS management
• security governance and risk management
• security incident governance