Cyber & Information Security Officer

Two; Glasgow; On-site; GBP 70,000 - 100,000; Full time

Job summary

Two is seeking an Information Security Officer to drive our cyber and data protection programme. You'll own how Two governs information security and personal data across the group, setting standards, managing risk, and proving compliance to regulators, clients and auditors.

This hands-on, high-ownership role works with our CTO, senior leadership and engineering teams, influencing how a growing fintech builds security and privacy into every product.

Qualifications

• Experience in information security GRC or data protection, ideally in fintech or financial services.
• Experience building or running an ISMS (ISO 27001, SOC 2).
• Strong knowledge of GDPR/UK GDPR and practical implementation experience.
• Familiarity with DORA or EBA ICT risk guidelines.
• Technical depth in cloud environments (GCP a plus).
• Clear, sharp writing for regulator letters, board updates, or internal comms.
• Ability to work independently with judgement focused on reducing risk.

Responsibilities

• Own and evolve ISMS and security policy framework aligned to ISO 27001 and DORA.
• Lead cyber and information risk management from assessments to board reporting.
• Manage third-party and ICT supplier risk including DPAs and due diligence.
• Lead GDPR programmes: records of processing, DPIAs, notices, data transfers.
• Assess incidents and data breaches; liaise with data protection authorities.
• Shape ICT and security for Swedish credit institution licence.
• Respond to client security and privacy due diligence.
• Run security and privacy awareness for staff.

Skills

InfoSec GRC

Data protection

ISMS implementation

GDPR/UK GDPR

DORA familiarity

Cloud security

Writing skills

Independent judgement

Job description

About Two

Two builds the decisioning platform behind B2B commerce. Businesses use our SaaS platform for credit decisioning, identity verification and fraud prevention, so they can say yes to more buyers, faster and more safely. We handle over €1Bn annually across Norway, Sweden and the UK; and we’re on the path to becoming a licensed credit institution in Sweden.

The role

We're looking for an Information Security Officer to drive our cyber and data protection programme. You'll own how Two governs information security and personal data across the group - setting the standards, managing the risk, and making sure we can prove it to regulators, clients and auditors.

This is a hands-on, high-ownership role. You'll work closely with our CTO, senior leadership, business and engineering teams. You will have real influence over how a growing, regulated fintech builds security and privacy into everything it does.

What you'll do

• Own and evolve our ISMS and security policy framework, aligned to ISO 27001 and DORA
• Run cyber and information risk management, from risk assessments to board-level reporting
• Lead third-party and ICT supplier risk - tiering, due diligence, DPAs and ongoing review
• Lead our EEA-EU GDPR / UK GDPR programme: records of processing, DPIAs, privacy notices, data subject requests and international transfers
• Assess incidents and personal data breaches, and act as our point of contact with data protection authorities
• Shape the ICT and security side of our Swedish credit institution licence
• Answer client security and privacy due diligence with confidence
• Run our security and privacy awareness programme for all staff

What you'll bring

• Solid experience in information security GRC and/or data protection, ideally in fintech, payments or financial services
• Practical experience building or running an ISMS (ISO 27001, SOC 2 or similar)
• Strong working knowledge of GDPR / UK GDPR - not just the theory, but how to make it work day to day
• Familiarity with DORA or EBA ICT risk guidelines
• Enough technical depth in cloud environments (GCP a plus) to challenge engineers credibly
• Clear, sharp writing - equally at home drafting a regulator letter, a board update or a Slack message
• The confidence to work independently and the judgement to focus on what genuinely reduces risk

Nice to have

• CISSP, CISM, CISA, ISO 27001 Lead Implementer/Auditor, CIPP/E or CIPM
• Experience supporting a banking or payments licence application
• PCI DSS, KYC/KYB or fraud‑prevention data experience

What we offer

This is a rare opportunity to take a young fintech from startup to regulated scale‑up, laying the policy foundations for our future as a fully operational bank. You'll shape the ICT and security side of Two becoming a licensed credit institution, and you'll deal directly with the regulators as you do it.

Solid foundations with a real mandate. You'll not start from scratch. Our policy framework, vendor register and training programme already exist. We need someone to take them from good to great.

A seat at the table. You'll work directly with our CTO and leadership team. Your judgement will guide the company's future growth.

Modern ways of working. We run cloud-native on Google Cloud and use AI tools every day. You'll help us to move fast, safely.