About Finom
Finom is a European tech startup that provides an all-in-one financial B2B platform integrating banking, accounting, financial management, and invoicing. Its platform includes AI-enabled accounting and serves entrepreneurs across European markets.
Responsibilities
•Maintain ISMS and ICT risk management framework records, including the document and records register, control ownership, and evidence repository
•Perform and refresh information security risk assessments, maintain the risk register, prepare risk treatment plans, and track their implementation with control owners
•Prepare for and manage internal and external audits, certifications, and assessments; own the calendar, collect evidence, work with auditors, and track findings to closure
•Check control design and operating effectiveness periodically and raise gaps for remediation
•Draft and maintain information security policies, procedures, and guidelines, and prepare them for annual review and approval
•Collect and analyse ISMS KPIs and KRIs and prepare regular security and risk reports for management
•Assess new suppliers and periodically reassess existing ones with Risk, Legal, and the DPO
•Prepare responses to security and compliance questionnaires from partners, customers, and regulators
•Review new projects, products, and vendors for information security and compliance
•Track changes in cybersecurity, ICT risk, and privacy regulation and supervisory guidance, assess their impact, and propose required changes
•Keep company-wide security awareness and training materials relevant and up to date
•Automate evidence collection, control checks, questionnaire responses, and reporting using templates, scripts, and AI tools
Requirements
•4+ years of experience in information security compliance, ISMS, GRC, or related areas
•Practical experience working with an ISMS based on ISO/IEC 27001 and preparing for and completing certification or surveillance audits
•Experience with information security risk assessments, risk registers, and risk treatment plans
•Experience answering security questionnaires and due diligence requests from partners, customers, or regulators
•Ability to translate standards and regulatory requirements into practical controls, procedures, and evidence that people follow
•A hands-on, self-driven approach; ability to own tasks end to end and work directly with people to solve problems
•Openness to AI tools and automation and active use of them in day-to-day work
•Strong written English and clear documentation skills
Nice to have
•Experience in banking, payments, or an EMI
•PCI DSS, SWIFT CSP, or payment scheme assessments
•Knowledge of DORA, NIS2, and GDPR, including working with a DPO on RoPA and DPIA
•Vendor security assessment and third-party risk experience
•ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC, or CISM certifications
Conditions
•Stock Options Program available to every team member
•Opportunities for continuous personal and professional development
•Work & Swim Program: one month in a corporate apartment in Cyprus
