About the role
Our client is a premium Merchant of Record (MoR) that processes software sales for companies all over the world. That makes Information Security less of a checkbox and more of a trust layer the whole business runs on. They're looking for someone to own that layer — and to turn security into an engineering-aligned capability, not a gatekeeper. A build-and-shape role, reporting straight to the VP IT & Infrastructure.
THE ROLE
You own the company's security posture end to end — strategy, standards, and the day-to-day reality of keeping a payments platform safe. You don't write policies that sit in a wiki; you embed security into how software actually gets built and operated: secure-by-design with Engineering, audit-readiness for PCI-DSS and SOC 2, and a risk landscape made visible through KPIs people act on. You lead a small team and act as the trusted voice on security — internally, and when it counts, in front of customers, partners, and auditors.
WHAT YOU'LL DO
* Own and continuously improve the overall security posture, with measurable KPIs that keep risk transparent. * Define and evolve the information security strategy in lockstep with business goals and a moving threat landscape. * Embed security into the SDLC and platform operations with Engineering — secure-by-design as the default. * Set pragmatic, risk-based standards and guardrails so teams ship secure solutions without slowing down. * Get the organisation audit-ready for PCI-DSS and SOC 2 by translating compliance into practical, scalable controls. * Strengthen detection and response through logging, monitoring, and alerting across apps and infrastructure. * Drive build-versus-buy decisions on security tooling, and represent security to customers, partners, and auditors.
WHAT YOU BRING
The real must-haves:
* 7+ years in Information Security or Security Engineering, ideally in cloud-based or SaaS environments. * Deep understanding of how modern applications and platforms are built and operated — credible with engineers. * Hands-on grasp of application architectures, APIs, IAM, and distributed-system vulnerabilities. * Working familiarity with PCI-DSS and SOC 2 (or comparable) and how to turn them into controls that scale. * Experience leading and developing small teams. * Fluent English, written and spoken.
Nice-to-haves:
* Background in environments handling sensitive, payment-related data. * Exposure to security considerations in AI-enabled environments. * A degree in Computer Science, IT, Cybersecurity — or equivalent depth earned in practice. * German.
WHAT'S IN IT FOR YOU
* A genuine shape-it mandate, reporting directly to the VP IT & Infrastructure. * Work hybrid or fully remote — with flexible hours. * A personal L&D budget and structured development programs. * Health & well-being benefits, pension/retirement plans, referral bonuses, and more. * A 200+ person, 30+ nationality team where people tend to stay.
This role is placed by Characters Connection. We don't fill seats — we connect Characters. Every application is handled with discretion; the client's identity is disclosed upon mutual interest.
Interested — or know someone who fits? Apply directly via this page or reach out to .
Originally posted on Himalayas