Head of Security — SaaS & Zero-Carbon Impact (Hybrid Helsinki)

SimaPro; Uusimaa; Hybrid; EUR 120,000 - 180,000; Full time

Benefits offered by this job

Security function ownership

Hybrid work with Helsinki presence

Direct CTO access

Zero-carbon focus

Global SaaS security exposure

Job summary

SimaPro seeks an experienced Head of Security to lead security across our global SaaS products and internal IT. This hands-on practitioner-leader role operates hybrid from Helsinki, with flexibility and a direct line to the CTO.

The role drives policy, incident response, and audits while aligning with GDPR and data protection obligations. You will manage a security analyst, coordinate with DevOps, IT, and support teams, and influence security practices without owning every system.

Qualifications

• Experience in cloud and production infrastructure security partnering with DevOps and platform teams.
• Influence-driven security mindset in an organisation where security doesn't own all systems.
• Deep knowledge of SSO, endpoint management, SaaS governance and integrations.
• Experience handling incident response under pressure and communicating with executives.

Responsibilities

• Own security strategy, standards, and policy across product and company.
• Lead hands-on application security including threat modelling and code review.
• Own end-to-end incident response planning and exercises.
• Manage ISO 27001, SOC 2 renewals and customer security reviews.
• Coordinate with platform, IT, and support to secure internal systems (SaaS only).
• Support GDPR and data protection obligations.
• Lead a security analyst and mentor the team.

Skills

Security leadership in practice

Cloud security collaboration

Incident command experience

ISO 27001 / SOC 2 familiarity

GDPR / data protection knowledge

Communication to executives

Education

CISSP / CISM / CISA certifications

Tools

SSO security

Endpoint management

Job description

SimaPro seeks an experienced Head of Security to lead security across our global SaaS products and internal IT. This hands-on practitioner-leader role operates hybrid from Helsinki, with flexibility and a direct line to the CTO.

The role drives policy, incident response, and audits while aligning with GDPR and data protection obligations. You will manage a security analyst, coordinate with DevOps, IT, and support teams, and influence security practices without owning every system.