Head of InfoSec & Compliance

🛡️ Head of Compliance & InfoSec

As Head of Compliance & InfoSec, you will serve as the company's ultimate authority on information security, data protection, and regulatory governance. You will design, implement, and continually mature the risk management frameworks that protect our products, infrastructure, enterprise customers, and global operations.

This is a hands-on executive leadership role. You will set overall strategic direction, oversee external audits, and collaborate closely with Engineering, Legal, Product, and C-suite stakeholders to embed an operational, security-first posture throughout the organization.

🚀 Key Responsibilities

🔐 Framework Management: Own and mature the company’s Information Security Management System (ISMS) aligned with ISO 27001 and SOC 2 Type II standards, overseeing third-party audits and maintaining active certifications.

🇪🇺 Data Protection & GDPR: Direct the enterprise GDPR compliance programme, overseeing data mapping, DPIAs, records of processing activities, data subject rights requests, and supervisory authority communications.

🏗️ Policy Governance: Define, deploy, and maintain organizational InfoSec policies, technical standards, and baseline controls across cloud environments, product architecture, and internal operations.

🔍 Risk & Vulnerability Management: Direct periodic risk assessments, threat modeling, and vulnerability management workflows, converting technical audit findings into prioritized remediation roadmaps.

🎓 Security Culture: Lead company-wide InfoSec training initiatives to cultivate continuous regulatory awareness and proactive security hygiene across all departments.

🤝 Audit & Regulator Liaison: Serve as the primary contact for external auditors, independent penetration testers, legal counsel, and regulatory authorities.

💼 Commercial Enablement: Lead InfoSec due diligence workflows for enterprise prospects, completing customer security assessments and supporting commercial negotiations.

🕵️♂️ Vendor Risk Management: Oversee the third-party risk management (TPRM) framework to continuously assess critical vendors, cloud providers, and sub-processors.

🚨 Incident Response & Resilience: Maintain and refine Incident Response (IR) and Business Continuity / Disaster Recovery (BC/DR) frameworks, leading executive tabletop exercises.

📊 Board Reporting: Report key InfoSec metrics, risk exposure, regulatory updates, and strategic roadmaps directly to executive leadership and the Board of Directors.

🎯 Candidate Qualifications

Minimum Requirements:

🕵️ Experience: 7+ years of progressive experience in InfoSec, IT compliance, or enterprise risk management, including 2+ years in a senior leadership role.

📜 ISO 27001 Leadership: Proven track record leading ISO 27001 implementation, certification, or operational governance.

🎯 SOC 2 Proficiency: In-depth technical familiarity with SOC 2 Type II Trust Services Criteria audit execution and control mapping.

⚖️ GDPR & SaaS Compliance: Expert knowledge of global data privacy regulations (GDPR, CCPA) applied practically within SaaS or cloud environments.

🗣️ Regulatory Translation: Exceptional capability to translate complex regulatory mandates into pragmatic technical controls and operational workflows.

💻 SDLC Security Integration: Demonstrated experience partnering with Engineering and Product organizations to embed InfoSec practices within the DevSecOps pipeline.

📣 Executive Communication: Highly articulated verbal and written presentation skills with experience briefing C-level executives and external partners.

Preferred Qualifications:

🏅 Industry Certifications: Active professional credentials such as CISSP, CISM, CISA, or ISO 27001 Lead Auditor/Implementer.

☁️ Cloud Infrastructure: Technical familiarity with cloud architecture security (AWS, GCP, or Azure) in a high-growth SaaS business.

📚 Extended Frameworks: Strategic knowledge of supplementary frameworks including NIST CSF, CIS Controls, or eIDAS.

🤝 Enterprise Assurance: Direct experience navigating complex enterprise customer InfoSec reviews and vendor risk assessments.

🎁 Position Offerings

🏆 Executive Impact: High-visibility leadership position with direct oversight of enterprise trust and strategic risk decisions.

🇧🇬 Full Remote Work (Bulgaria): Complete location flexibility within Bulgaria, with high autonomy over your schedule and work environment.

💰 Competitive Package: Market-leading compensation structure subject to performance and annual reviews.

🚀 Agile Governance: Streamlined decision-making environment designed for direct accountability and rapid execution.

🎨 Strategic Build Opportunity: Full authority to shape, scale, and mature an enterprise-grade InfoSec and compliance function.

🌐 Ready to define, scale, and own our global security architecture? We look forward to receiving your application and exploring how you can shape our compliance future. 🚀