Head of Security for a Sustainability SaaS

SimaPro; Uusimaa; Hybrid; EUR 120,000 - 180,000; Full time

Benefits offered by this job

Security function ownership

Hybrid work with Helsinki presence

Direct CTO access

Zero-carbon focus

Global SaaS security exposure

Job summary

SimaPro seeks an experienced Head of Security to lead security across our global SaaS products and internal IT. This hands-on practitioner-leader role operates hybrid from Helsinki, with flexibility and a direct line to the CTO.

The role drives policy, incident response, and audits while aligning with GDPR and data protection obligations. You will manage a security analyst, coordinate with DevOps, IT, and support teams, and influence security practices without owning every system.

Qualifications

• Experience in cloud and production infrastructure security partnering with DevOps and platform teams.
• Influence-driven security mindset in an organisation where security doesn't own all systems.
• Deep knowledge of SSO, endpoint management, SaaS governance and integrations.
• Experience handling incident response under pressure and communicating with executives.

Responsibilities

• Own security strategy, standards, and policy across product and company.
• Lead hands-on application security including threat modelling and code review.
• Own end-to-end incident response planning and exercises.
• Manage ISO 27001, SOC 2 renewals and customer security reviews.
• Coordinate with platform, IT, and support to secure internal systems (SaaS only).
• Support GDPR and data protection obligations.
• Lead a security analyst and mentor the team.

Skills

Security leadership in practice

Cloud security collaboration

Incident command experience

ISO 27001 / SOC 2 familiarity

GDPR / data protection knowledge

Communication to executives

Education

CISSP / CISM / CISA certifications

Tools

SSO security

Endpoint management

Job description

We are looking for an experienced security professional to serve as our Head of Security, leading security across our globally used SaaS products and internal IT environment. This is a hands‑on practitioner‑leader role, not an oversight role for an established function.

One Click LCA is the construction industry’s leading digital platform for Life Cycle Assessment for buildings, infrastructure, and manufacturing. As a fast-growing, well-funded, and profitable B2B SaaS business, our solutions are used in over 170 countries, across +50,000 global construction projects, with +300,000 certified construction data points, and trusted by the biggest names in construction and manufacturing.

You will join a supportive, effective, and mission‑oriented team in a flexible, friendly, and international work environment, with a great deal of autonomy in your role.

This full‑time, permanent position is available on a hybrid basis for candidates based in Helsinki.

Due to the nature of this role and applicable security requirements, preference will be given to candidates who are EU citizens or otherwise eligible to obtain the required security clearances.

What you will do:

• Own security as a discipline across both product and company perspectives, setting or updating strategy, standards and policy where needed.
• Own application security hands‑on: threat modelling, secure design principles and code review practices, penetration test scoping and triage.
• Own incident response end‑to‑end: the plan, the tabletop exercises, and being ready for the day we need it.
• Manage ISO 27001, SOC 2 and other standard renewal efforts, and support customer security reviews, questionnaires and audits.
• Work with our platform, internal IT and support teams to secure our internal systems and processes. We run entirely on SaaS, with no self‑hosted servers.
• Support our GDPR and data protection obligations.
• Act as a manager to our security analyst who supports you in your area.

What you need:

• Cloud and production infrastructure security experience, working in partnership with DevOps and platform teams rather than running the infrastructure yourself.
• Experience operating through influence rather than headcount, in an organisation where security doesn’t own the systems it’s accountable for.
• Corporate and identity security depth in SSO, endpoint management, email, SaaS governance and integrations, with good judgment about where the real risk sits.
• Incident command experience under real pressure, and the composure that goes with it.
• Credibility in both directions: you can hold your own in a system review and be clear with an executive audience the same afternoon.
• Familiarity with SOC 2, ISO 27001 and GDPR, enough to set direction without needing to run the audit yourself. CISSP, CISM or CISA are welcome but won’t substitute for hands‑on depth.

What we offer:

• A security function you define rather than inherit, including cost management, processes and tooling related to security.
• The combination of SaaS product security and internal security in a global company.
• Work in a growing business that helps bring about a zero‑carbon future.
• Remote days are supported, though we hope you will also enjoy collaborating with colleagues in our Helsinki office 2-3 days a week.
• A friendly, motivated and diverse team of experienced professionals, social events, and the chance to contribute to a zero‑carbon future.
• No bureaucracy: direct communication with the CTO and executive team, and a short path from problem to decision.