Information Security Lead

Aspora is a borderless financial operating system that moves money between the EU, the UK, the UAE and India. This role is the named local owner of ICT risk, information security and IT for the EU entity, responsible for making the company's security posture provable to any regulator, auditor or partner bank. The role works daily with Infrastructure, DevOps and the Head of Engineering, reporting to the COO, and is built to grow into a senior security leadership seat.

Responsibilities

Build and run the DORA risk framework, policies, risk register and third-party register; Represent the EU entity to the Bank of Lithuania, auditors and partner banks on IT and security matters, and close findings before they age; Run the group ISO 27001 and PCI-DSS programme for the EU entity; Own the incident-response playbook including the regulatory notification path; Run DR and BCP drills; Act as the technical counterpart to the DPO on DPIAs, transfer assessments and breach notifications; Convert audit and regulatory requirements into engineering tickets with owners and dates and follow them to closure; Own devices, identity and access, SaaS tooling and joiner/mover/leaver processes for EU staff

Requirements

Worked in regulated financial services; Run information security or ICT risk inside a bank, EMI, payment institution or fintech; Sat across from the regulator during inspections or incident notifications; Owned or materially run ISO 27001, SOC 2 or PCI-DSS certification cycles end to end, from scoping through evidence to closing findings; Read AWS access controls and vulnerability scans and hold a technical conversation with engineers; Run incident response and DR drills hands-on and made regulatory notification calls under pressure; Work in Lithuanian and English

Benefits

Competitive salary; Comprehensive benefits; ESOPs aligned with Aspora's long-term vision; Room to grow the function as Aspora grows