Information Security Officer

Finom; Madrid; On-site; EUR 70,000 - 90,000; Full time

Job summary

Finom is seeking an Information Security Officer to own security compliance and risk management within the Cyber Security team in Madrid. You will maintain the ISMS, run risk assessments, and coordinate audits with audit partners, risk, legal and the DPO.

You’ll craft policies, report KPIs, and drive improvements across suppliers and projects. You will work hands-on, translate regulatory requirements into practical controls, and leverage AI tooling to automate evidence collection and reporting.

Qualifications

• Experience with information security compliance, ISMS, and risk management.
• Hands-on with ISO/IEC 27001 certification processes and audits.
• Strong written English and documentation skills.
• 4+ years in information security compliance, GRC, or related areas.
• Experience with banking, payments or EMIPCI DSS, SWIFT CSP, or payment schemes.
• Knowledge of DORA, NIS2 and GDPR including RoPA and DPIA with a DPO.
• Certifications such as ISO 27001 Lead Implementer/Auditor, CISA/CRISC/CISM.

Responsibilities

• Maintain ISMS records, risk register, and evidence repository.
• Perform and refresh risk assessments, track treatment plans.
• Prepare for audits, collect evidence, coordinate with auditors.
• Review projects for information security and privacy compliance.
• Run control design and effectiveness checks and raise remediation gaps.
• Develop and maintain security policies and guidelines.
• Prepare security and risk reports for management.
• Assess new suppliers and revisit existing ones with Risk, Legal and DPO.
• Answer security questionnaires from partners, customers, regulators.
• Automate evidence collection and reporting with templates, scripts, AI tooling.

Skills

Information security

Risk management

Policy development

Documentation

English writing

Education

ISO 27001 Lead Implementer

CISA

CRISC

CISM

Tools

AI tooling

Automation scripts

Security questionnaires

Job description

• Finom is a licensed EMI operating across several EU markets, where information security and compliance are a big part of how we work. We’re looking for an Information Security Officer to join our Cyber Security team and take ownership of security compliance and risk management day to day
• You won’t be starting from a blank page. We already have a mature, certified ISMS and established processes for risk management, audits, vendor assessments and reporting. Your role is to get to know what we have, keep it running well, spot opportunities to make it better and make sure compliance works in practice, not just on paper
• You’ll report directly to the CISO and work closely with our Cyber Security and Engineering teams, as well as Risk, Legal & Compliance, Internal Audit and other teams across the company
• Maintain the ISMS and ICT risk management framework records: document and records register, control ownership and evidence repository
• Perform and refresh information security risk assessments, maintain the risk register, prepare risk treatment plans and track their implementation with control owners
• Prepare for and go through internal and external audits, certifications and assessments: own the calendar, collect evidence, work directly with auditors and track findings to closure
• Run periodic checks of control design and operating effectiveness and raise gaps for remediation
• Draft and maintain information security policies, procedures and guidelines and prepare them for annual review and approval
• Collect and analyse ISMS KPIs and KRIs and prepare the regular security and risk reporting for management
• Perform security assessments of new suppliers and periodic reassessments of existing ones together with Risk, Legal and the DPO
• Prepare responses to security and compliance questionnaires from partners, customers and regulators
• Review new projects, products and vendors from an information security and compliance perspective
• Track changes in cybersecurity, ICT risk and privacy regulation and supervisory guidance, assess impact and propose required changes
• Keep company-wide security awareness and training materials relevant and up to date
• Automate evidence collection, control checks, questionnaire answering and reporting with templates, scripts and AI tooling

Experience answering security questionnaires and due diligence requests from partners, customers or regulatorsExperience with information security risk assessments, risk registers and risk treatment plansOpen to AI tools and automation and actively use them in day-to-day workHands-on and self-driven: you own tasks end to end, work directly with people to solve problems and do not wait for a perfect methodology before actingStrong written English and clear documentation skillsPractical experience with ISO/IEC 27001: working with an ISMS and preparing for and going through certification or surveillance audits4+ years of experience in information security compliance, ISMS, GRC or related areasAble to translate standards and regulatory requirements into practical controls, procedures and evidence that people actually followExperience in banking, payments or an EMIPCI DSS, SWIFT CSP or payment scheme assessmentsKnowledge of DORA, NIS2 and GDPR, including working with a DPO on RoPA and DPIAVendor security assessment and third-party risk experienceCertifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC or CISM