Job summary
This role is responsible for leading and managing the organization's cyber and data protection programs. The officer will develop and maintain security policies aligned with recognized standards, oversee risk management activities, ensure compliance with GDPR and other regulatory requirements, and handle security incidents and communications with regulators. Working closely with leadership and technical teams, the role influences the integration of security and privacy in a regulated fintech environment.
Location and work setup
- Location
- Oslo
- Work setup
- On-site
Responsibilities
Lead the development and evolution of the Information Security Management System and security policies consistent with ISO 27001 and relevant regulations. Manage cyber and information risk assessments and reporting, including board-level communication. Oversee third-party and ICT supplier risk management, ensuring due diligence and ongoing reviews. Administer GDPR compliance efforts, including processing records, impact assessments, privacy notices, and data subject requests. Assess and respond to security incidents and data breaches, acting as the primary liaison with data protection authorities. Support regulatory licensing requirements related to ICT and security. Conduct security and privacy due diligence for clients and run awareness programs for staff.
Qualifications
Proven experience in information security governance, risk, and compliance, preferably within fintech, payments, or financial services sectors. Hands-on expertise in developing or managing an ISMS based on ISO 27001, SOC 2, or similar standards. Strong and practical understanding of GDPR and related data protection laws. Familiarity with DORA or ICT risk frameworks from financial authorities. Technical knowledge of cloud environments, especially Google Cloud Platform, to effectively engage with engineering teams. Excellent written communication skills adaptable to various audiences. Ability to work independently with strong judgment focused on risk reduction. Professional certifications such as CISSP, CISM, CISA, ISO 27001 Lead Implementer/Auditor, or CIPP/E are advantageous but not mandatory.