Cyber & Information Security Officer

Two AS; United Kingdom; Remote; GBP 90,000 - 130,000; Full time

Job summary

Two is seeking an Information Security Officer to drive cyber and data protection across the group. You will own governance, set standards, manage risk, and demonstrate compliance to regulators, clients and auditors. This is a hands‑on, high‑ownership role shaping security in a growing fintech.

You will collaborate with the CTO, leadership and engineering teams to embed security and privacy into everything the company does, including future licensing work in the UK and EU.

Qualifications

• Solid experience in information security GRC and/or data protection, ideally in fintech, payments or financial services.
• Practical experience building or running an ISMS (ISO 27001, SOC 2 or similar).
• Strong working knowledge of GDPR / UK GDPR — not just the theory, but how to make it work day to day.
• Familiarity with DORA or EBA ICT risk guidelines.
• Enough technical depth in cloud environments (GCP a plus) to challenge engineers credibly.
• Clear, sharp writing — equally at home drafting a regulator letter, a board update or a Slack message.
• The confidence to work independently and the judgement to focus on what genuinely reduces risk.

Responsibilities

• Own and evolve our ISMS and security policy framework, aligned to ISO 27001 and DORA
• Run cyber and information risk management, from risk assessments to board‑level reporting
• Lead third‑party and ICT supplier risk — tiering, due diligence, DPAs and ongoing review
• Lead our EEA‑EU GDPR / UK GDPR programme: records of processing, DPIAs, privacy notices, data subject requests and international transfers
• Assess incidents and personal data breaches, and act as our point of contact with data protection authorities
• Shape the ICT and security side of our Swedish credit institution licence
• Answer client security and privacy due diligence with confidence
• Run our security and privacy awareness programme for all staff

Skills

Information security GRC

Data protection

ISMS design & operation

Regulatory reporting

Policy writing

Education

CISSP, CISM, CISA, ISO 27001 Lead Implementer/Auditor, CIPP/E or CIPM

Tools

GCP / cloud security

DORA / EBA ICT risk guidelines

GDPR implementation

Job description

About Two

Two builds the decisioning platform behind B2B commerce. Businesses use our SaaS platform for credit decisioning, identity verification and fraud prevention, so they can say yes to more buyers, faster and more safely. We handle over €1Bn annually across Norway, Sweden and the UK; and we're on the path to becoming a licensed credit institution in Sweden.

The role

We're looking for an Information Security Officer to drive our cyber and data protection programme. You'll own how Two governs information security and personal data across the group — setting the standards, managing the risk, and making sure we can prove it to regulators, clients and auditors.

This is a hands‑on, high‑ownership role. You'll work closely with our CTO, senior leadership, business and engineering teams. You will have real influence over how a growing, regulated fintech builds security and privacy into everything it does.

What you'll do

• Own and evolve our ISMS and security policy framework, aligned to ISO 27001 and DORA




• Run cyber and information risk management, from risk assessments to board‑level reporting




• Lead third‑party and ICT supplier risk — tiering, due diligence, DPAs and ongoing review




• Lead our EEA‑EU GDPR / UK GDPR programme: records of processing, DPIAs, privacy notices, data subject requests and international transfers




• Assess incidents and personal data breaches, and act as our point of contact with data protection authorities




• Shape the ICT and security side of our Swedish credit institution licence




• Answer client security and privacy due diligence with confidence




• Run our security and privacy awareness programme for all staff

What you'll bring

• Solid experience in information security GRC and/or data protection, ideally in fintech, payments or financial services




• Practical experience building or running an ISMS (ISO 27001, SOC 2 or similar)




• Strong working knowledge of GDPR / UK GDPR — not just the theory, but how to make it work day to day




• Familiarity with DORA or EBA ICT risk guidelines




• Enough technical depth in cloud environments (GCP a plus) to challenge engineers credibly




• Clear, sharp writing — equally at home drafting a regulator letter, a board update or a Slack message




• The confidence to work independently and the judgement to focus on what genuinely reduces risk

Nice to have

• CISSP, CISM, CISA, ISO 27001 Lead Implementer/Auditor, CIPP/E or CIPM




• Experience supporting a banking or payments licence application




• PCI DSS, KYC/KYB or fraud‑prevention data experience

What we offer

This is a rare opportunity to take a young fintech from startup to regulated scale‑up, laying the policy foundations for our future as a fully operational bank. You'll shape the ICT and security side of Two becoming a licensed credit institution, and you'll deal directly with the regulators as you do it.

Solid foundations with a real mandate. You'll not start from scratch. Our policy framework, vendor register and training programme already exist. We need someone to take them from good to great.

A seat at the table. You'll work directly with our CTO and leadership team. Your judgement will guide the company’s future growth.

Modern ways of working. We run cloud‑native on Google Cloud and use AI tools every day. You’ll help us to move fast, safely.