Head of Security for a Sustainability SaaS

One Click LCA Ltd.; Uusimaa; Hybride; EUR 120 000 - 180 000; Plein temps

Avantages offerts par ce poste

Remote work days

Hybrid Helsinki office 2–3 days/week

Direct CTO access

Résumé du poste

One Click LCA Ltd. is seeking an experienced Head of Security to lead security across our SaaS products and internal IT.

This hands-on practitioner-leader role will be based in Helsinki with hybrid work options and a focus on secure design, incident response, and regulator compliance. You will guide strategy, policies, and audits while collaborating with CTO, platform, and IT teams to ensure robust security across a fast-growing, global environment.

Qualifications

• Experience leading security across product and internal IT environments.
• Ability to influence security initiatives without owning all systems.
• Credible communication with executives and technical teams.
• Familiarity with ISO 27001, SOC 2 and GDPR requirements.

Responsabilités

• Own security as a discipline across product and company perspectives, setting or updating strategy, standards and policy where needed.
• Own application security hands-on: threat modelling, secure design principles and code review practices, penetration test scoping and triage.
• Own incident response end-to-end: the plan, the tabletop exercises, and being ready for the day we need it.
• Manage ISO 27001, SOC 2 and other standard renewal efforts, and support customer security reviews, questionnaires and audits.
• Work with our platform, internal IT and support teams to secure our internal systems and processes.
• Support our GDPR and data protection obligations.
• Act as a manager to our security analyst who supports you in your area.

Connaissances

Security leadership

Threat modelling

Incident response

SOC 2 knowledge

ISO 27001 knowledge

GDPR compliance

Security governance

Formation

Security certifications welcomed

Description du poste

We are looking for an experienced security professional to serve as our Head of Security, leading security across our globally used SaaS products and internal IT environment. This is a hands‑on practitioner‑leader role, not an oversight role for an established function.

One Click LCA is the construction industry’s leading digital platform for Life Cycle Assessment for buildings, infrastructure, and manufacturing. As a fast‑growing, well‑funded, and profitable B2B SaaS business, our solutions are used in over 170 countries, across +50,000 global construction projects, with +300,000 certified construction data points, and trusted by the biggest names in construction and manufacturing.

You will join a supportive, effective, and mission‑oriented team in a flexible, friendly, and international work environment, with a great deal of autonomy in your role.

This full‑time, permanent position is available on a hybrid basis for candidates based in Helsinki.

Due to the nature of this role and applicable security requirements, preference will be given to candidates who are EU citizens or otherwise eligible to obtain the required security clearances.

What you will do

• Own security as a discipline across both product and company perspectives, setting or updating strategy, standards and policy where needed.
• Own application security hands‑on: threat modelling, secure design principles and code review practices, penetration test scoping and triage.
• Own incident response end‑to‑end: the plan, the tabletop exercises, and being ready for the day we need it.
• Manage ISO 27001, SOC 2 and other standard renewal efforts, and support customer security reviews, questionnaires and audits.
• Work with our platform, internal IT and support teams to secure our internal systems and processes. We run entirely on SaaS, with no self‑hosted servers.
• Support our GDPR and data protection obligations.
• Act as a manager to our security analyst who supports you in your area.

What you need

• Cloud and production infrastructure security experience, working in partnership with DevOps and platform teams rather than running the infrastructure yourself.
• Experience operating through influence rather than headcount, in an organisation where security doesn't own the systems it's accountable for.
• Corporate and identity security depth in SSO, endpoint management, email, SaaS governance and integrations, with good judgment about where the real risk sits.
• Incident command experience under real pressure, and the composure that goes with it.
• Credibility in both directions: you can hold your own in a system review and be clear with an executive audience the same afternoon.
• Familiarity with SOC 2, ISO 27001 and GDPR, enough to set direction without needing to run the audit yourself. CISSP, CISM or CISA are welcome but won't substitute for hands‑on depth.

What we offer

• A security function you define rather than inherit, including cost management, processes and tooling related to security.
• The combination of SaaS product security and internal security in a global company.
• Work in a growing business that helps bring about a zero‑carbon future.
• Remote days are supported, though we hope you will also enjoy collaborating with colleagues in our Helsinki office 2‑3 days a week.
• A friendly, motivated and diverse team of experienced professionals, social events, and the chance to contribute to a zero‑carbon future.
• No bureaucracy: direct communication with the CTO and executive team, and a short path from problem to decision.

Application deadline: 31 October 2026

We train, equip and support the makers of a zero‑carbon future to tackle low‑carbon design, planning, manufacturing, and procurement using life‑cycle assessment to achieve zero.

This is how we do it

• We train everyone in the world to life‑cycle assessment via One Click LCA Academy for free.
• We provide software tools to decarbonize any project or product anywhere in the world.
• We create free resources and policy tools to power all the makers of zero‑carbon future.
• We aim to power one million users by 2035.

Maximizing our decarbonization impacts

• We’re training tens of thousands of people for free annually via One Click LCA Academy.
• We provide One Click LCA Planetary, a free embodied carbon software for everyone.
• We author free policy papers and best practice guidelines for governments and businesses.
• Supporting decarbonization outside our direct business.
• We invested over 150 000 EUR in the creation of a surplus construction materials marketplace business to reduce site wastage and advanced regulations supporting this activity.
• We have invested 150 000 EUR in the construction of new primary wind power in Finland.
• We donate annually to a number of sustainability NGOs in line with our mission.

Minimizing our internal carbon impacts

• We’re a proud signatory of the World Green Building Council Net Zero commitment and shall achieve zero carbon facilities by 2030.
• We’ve invested in primary wind power generation capacity to power our entire operations.
• We minimize travel emissions by supporting remote work and encouraging public transport.
• We do not serve meat in any company events or dinners and use plant‑based milk.
• We operate a paperless business.
• We have a very supportive, highly expert, and friendly team of colleagues.
• We leave staff a great deal of autonomy & freedom; you can get done what needs to get done.
• We have a low hierarchy and support an open flow of information.
• Our team is highly international and represents well over 40 nationalities.
• We work on the same mission together with our customers to create a zero‑carbon future.

One Click LCA is a Helsinki‑based tech company decarbonizing construction and manufacturing with world‑leading, easy‑to‑use, and automated life‑cycle assessment (LCA) to calculate and reduce the environmental impacts of building, infrastructure, and renovation projects — as well as construction and other manufactured products. It also enables manufacturers to generate and publish third‑party verified EPDs and allows assessment of circularity, life‑cycle cost, and soon also biodiversity.

One Click LCA is used in +170 countries. Its decarbonization platform includes a unique global database with +500,000 LCA datasets, and it supports +140 standards and certifications, including LEED, BREEAM, GRESB and other national regulations.

One Click LCA was founded in Finland in 2001 and has a team of +330 people on all continents.

Learn more at: www.oneclicklca.com