Security Lead for a Sustainability SaaS

SimaPro; Helsinki; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Remote days supported

Hybrid work arrangement (Helsinki 2–3x

Direct access to CTO

Job summary

One Click LCA is seeking a Security Lead to own security across our software products, cloud infrastructure and internal IT environment. You will work with software engineering, platform and business teams to identify risks and implement effective controls.

This full-time, hybrid role is based in Helsinki and includes leadership of a security analyst, with focus on ISO 27001, SOC 2 and GDPR compliance, plus incident response readiness.

Qualifications

• Hands-on cloud and production infrastructure security experience.
• Strong understanding of application security and secure software architecture.
• Experience operating through influence in an org where security doesn’t own systems.
• Corporate and identity security depth in SSO, endpoint management and SaaS governance.
• Experience handling security incidents and improving incident response readiness.
• Credibility to present to executives after a system review.
• Familiarity with SOC 2, ISO 27001 and GDPR; CISSP/CISM/CISA welcome but not required.

Responsibilities

• Secure SaaS products, APIs and cloud infrastructure.
• Collaborate with engineering on security architecture, threat modelling and testing.
• Identify, validate and prioritise security risks and drive mitigations.

Skills

Cloud security

Application security

Incident response

Security governance

ISO 27001

SOC 2

GDPR compliance

Security leadership

Executive communication

Job description

We are looking for an experienced Security Lead to take ownership of security across our software products, cloud infrastructure and internal IT environment.

This is a broad, hands-on role combining three areas: product and cloud security, corporate IT security, and security governance and compliance.

You will work closely with our software engineering, platform and internal IT teams, as well as business stakeholders, to identify risks, implement effective controls and continuously improve how we operate.

You will have significant autonomy, work directly with the CTO and senior stakeholders, and manage an existing security analyst.

Why One Click LCA

One Click LCA is the construction industry’s leading digital platform for Life Cycle Assessment for buildings, infrastructure, and manufacturing. As a fast-growing, well-funded, and profitable B2B SaaS business, our solutions are used in over 170 countries, across +50,000 global construction projects, with +300,000 certified construction data points, and trusted by the biggest names in construction and manufacturing.

You will join a supportive, effective, and mission-oriented team in a flexible, friendly, and international work environment, with a great deal of autonomy in your role.

This full-time, permanent position is available on a hybrid basis for candidates based in Helsinki.

Due to the nature of this role and applicable security requirements, preference will be given to candidates who are EU citizens or otherwise eligible to obtain the required security clearances.

What you will do:

Product, application and cloud security

• Ensure the security of our SaaS products, applications, APIs and cloud infrastructure.
• Work hands-on with engineering teams on security architecture, threat modelling, vulnerability assessments and security testing.
• Identify, validate and prioritise security risks, and drive mitigations and practical improvements.

Internal IT and business SaaS security

• Oversee security across our internal IT environment including business SaaS applications.
• Work with IT and business teams to secure access, integrations and third-party services.
• Improve security monitoring, incident prevention and response.
• Own incident response end-to-end: the plan, the tabletop exercises, and being ready for the day we need it.

Security governance and compliance

• Own and continuously improve our security policies, processes and risk management.
• Manage ISO 27001, SOC 2 and other relevant security certifications, including customer security reviews, questionnaires and audits.
• Ensure security controls are effective, proportionate and practical for the business.
• Support our GDPR and data protection obligations.
• Manage and support our security analyst and coordinate security priorities across the company.

What you need:

• Hands-on cloud and production infrastructure security experience, working in partnership with DevOps and platform teams rather than running the infrastructure yourself.
• Strong understanding of application security, secure software architecture, APIs, authentication, authorisation, vulnerabilities and security testing.
• Experience operating through influence rather than headcount, in an organisation where security doesn't own the systems it's accountable for.
• Corporate and identity security depth in SSO, endpoint management, email, SaaS governance and integrations, with good judgment about where the real risk sits.
• Experience handling security incidents and improving incident response readiness. Incident command experience under pressure, and the composure that goes with it.
• Credibility in both directions: you can hold your own in a system review and be clear with an executive audience the same afternoon.
• Familiarity with SOC 2, ISO 27001 and GDPR, enough to set direction without needing to run the audit yourself. CISSP, CISM or CISA are welcome but won't substitute for hands-on depth.

What we offer:

• A security function you define rather than inherit, including cost management, processes and tooling related to security.
• The combination of SaaS product security and internal security in a global company.
• Work in a growing business that helps bring about a zero-carbon future.
• Remote days are supported, though we hope you will also enjoy collaborating with colleagues in our Helsinki office 2-3 days a week.
• A friendly, motivated and diverse team of experienced professionals, social events, and the chance to contribute to a zero-carbon future.
• No bureaucracy: direct communication with the CTO and executive team, and a short path from problem to decision.

Interested?

We are accepting applications until 15 November 2026. Applications are reviewed upon receipt, so please apply promptly to be considered.