Security Governance & Risk Compliance Lead

Quick Facts

• Role: Security Governance & Risk Compliance Lead (Technical Security & Governance)
• Focus: GRC, ISMS governance, ICT risk management, audits, third-party risk, incident governance, access management governance
• Team: Leads a small team of two Security Specialists

Description

Own and continuously improve the organization’s Information Security Management System (ISMS) and security governance, ensuring practical security processes aligned with business needs. Coordinate ICT risk assessments and maintain the risk register, manage security documentation and compliance evidence for audits, and oversee governance for incidents, access management, and operational resilience. Work closely with the CTO, Engineering, IT, Legal, and Compliance teams to deliver security and regulatory compliance outcomes.

Responsibilities

• Maintain and improve ISMS; develop and update internal security policies, procedures, and documentation
• Coordinate security requirements implementation; monitor effectiveness of security controls and identify gaps
• Prepare regular security reports for management
• Coordinate periodic ICT risk assessments; maintain and update the risk register
• Track risk treatment plans and remediation progress; support asset classification and ICT service criticality assessments
• Collaborate with Compliance and Legal to implement security requirements under DORA, MiCA, and related regulations
• Maintain security compliance evidence; coordinate audit preparation and evidence collection (internal/external/regulatory)
• Track audit findings and remediation actions
• Coordinate security assessments of ICT vendors and outsourcing partners; review SOC 2 / ISO 27001 evidence and questionnaires
• Maintain third-party security risk records and define contractual security requirements
• Maintain the security & ICT incident management framework; coordinate incident recording, classification, and documentation
• Oversee identity and access management governance (access reviews, onboarding/offboarding assessments)
• Coordinate security aspects of BIA, Business Continuity, Disaster Recovery, and operational resilience testing
• Coordinate security awareness training and practical security culture initiatives

Requirements

• 4+ years of experience in information security, IT risk management, or GRC
• Strong understanding of information security management principles and standards (ISO 27001 or NIST CSF)
• Practical experience with security risk assessments and risk register management
• Experience developing security documentation, policies, and internal procedures
• Understanding of IT environments, cloud services, identity management, and fundamental security controls
• Ability to assess technical risks and collaborate effectively with technical teams
• Experience with security audits, control reviews, or remediation tracking
• Ability to work independently, set priorities, and communicate effectively
• Good command of Czech and English

Benefits

• Opportunity to develop security governance in a growing regulated fintech company
• Independent role with direct impact on security processes and ICT risk management
• Close collaboration with CTO, Compliance, Legal, and technical teams
• Practical experience with European financial regulations and Czech National Bank supervision
• Room for initiative and continuous improvement of internal processes
• Flexible hybrid working environment