Head of Compliance & InfoSec

Head of Compliance & InfoSec

Position Overview

As Head of Compliance & InfoSec, you will serve as the organizational authority on information security, data privacy, and regulatory governance. In this capacity, you will architect, implement, and continually mature the enterprise risk management frameworks safeguarding our cloud infrastructure, core products, and international customer base.

This is a high-visibility leadership role requiring an optimal balance of strategic oversight and operational execution. You will define security strategy, direct external audit engagements, and partner closely with Engineering, Legal, Product, and Executive leadership to instill a resilient, security-first operational posture across all business units.

Key Responsibilities

• Governance Frameworks: Architect and mature the enterprise Information Security Management System (ISMS) in alignment with ISO 27001 and SOC 2 Type II standards, directing audit preparation and maintaining certifications.

• Data Privacy & GDPR: Direct the corporate GDPR compliance program—overseeing data mapping, DPIAs, records of processing activities (ROPA), data subject requests, and regulatory communications.

• Policy Architecture: Define and enforce global InfoSec policies, baseline security controls, and technical standards across cloud operations and internal software development processes.

• Risk Management: Direct enterprise risk assessments and vulnerability management initiatives, translating technical audit findings into prioritized remediation plans.

• Security Awareness: Design and implement company-wide InfoSec training programs to foster continuous regulatory compliance and security awareness.

• External Stakeholder Management: Function as the primary liaison for independent auditors, penetration testing firms, legal counsel, and regulatory bodies.

• Commercial Enablement: Support enterprise sales cycles by overseeing vendor risk assessments, completing complex security questionnaires, and establishing customer trust.

• Third-Party Risk (TPRM): Manage the vendor security evaluation program to ensure continuous oversight of critical suppliers and sub-processors.

• Business Continuity: Maintain Incident Response (IR) and Business Continuity / Disaster Recovery (BC/DR) protocols, leading routine executive simulation exercises.

• Executive Reporting: Provide structured reporting to executive leadership and the Board of Directors regarding risk exposure, compliance metrics, and strategic roadmaps.

Core Requirements:

• Language Proficiency: Full professional fluency in English, both written and spoken, with the ability to lead enterprise-level technical and legal discussions.

• Experience: 7+ years of progressive experience within InfoSec, IT compliance, or enterprise risk management, including 2+ years in a senior leadership role.

• ISO 27001 Expertise: Proven track record of spearheading ISO 27001 implementation, certification, or operational governance.

• SOC 2 Proficiency: Comprehensive technical command of SOC 2 Type II Trust Services Criteria audit management.

• GDPR & Privacy: Expert knowledge of international data protection regulations (GDPR, CCPA) within SaaS or cloud environments.

• SDLC Integration: Experience collaborating with Engineering teams to embed security requirements into modern software development lifecycles (DevSecOps).

• Stakeholder Engagement: Superior written and oral presentation skills, capable of briefing senior executives and enterprise clients.

Preferred Qualifications:

• Industry Credentials: Recognized certifications such as CISSP, CISM, CISA, or ISO 27001 Lead Auditor/Implementer.

• Cloud Architecture: Hands-on familiarity with cloud security posture management (AWS, GCP, or Azure) in a SaaS architecture.

• Regulatory Frameworks: Exposure to supplementary frameworks including NIST CSF, CIS Controls, or eIDAS.

• Enterprise Assurance: Direct experience navigating complex enterprise procurement reviews and security addendums.

What We Offer

• Strategic Ownership: Executive-level autonomy with direct influence over company-wide risk management and compliance posture.

• Work Flexibility: 100% Remote within Bulgaria or Hybrid from our Plovdiv office—your choice based on how you work best.

• Executive Compensation: Competitive compensation package evaluated annually against market benchmarks.

• Agile Culture: High-efficiency, low-bureaucracy operating environment designed for rapid execution and decision-making.

• Impactful Mandate: The opportunity to build, scale, and mature an enterprise-grade InfoSec organization from the ground up.

Ready to define, scale, and own our global security architecture? We look forward to receiving your application and exploring how you can shape our compliance future.