Fintech Information Security Lead — ISO27001 & GDPR

Two; Glasgow; On-site; GBP 70,000 - 100,000; Full time

Job summary

Two is seeking an Information Security Officer to drive our cyber and data protection programme. You'll own how Two governs information security and personal data across the group, setting standards, managing risk, and proving compliance to regulators, clients and auditors.

This hands-on, high-ownership role works with our CTO, senior leadership and engineering teams, influencing how a growing fintech builds security and privacy into every product.

Qualifications

• Experience in information security GRC or data protection, ideally in fintech or financial services.
• Experience building or running an ISMS (ISO 27001, SOC 2).
• Strong knowledge of GDPR/UK GDPR and practical implementation experience.
• Familiarity with DORA or EBA ICT risk guidelines.
• Technical depth in cloud environments (GCP a plus).
• Clear, sharp writing for regulator letters, board updates, or internal comms.
• Ability to work independently with judgement focused on reducing risk.

Responsibilities

• Own and evolve ISMS and security policy framework aligned to ISO 27001 and DORA.
• Lead cyber and information risk management from assessments to board reporting.
• Manage third-party and ICT supplier risk including DPAs and due diligence.
• Lead GDPR programmes: records of processing, DPIAs, notices, data transfers.
• Assess incidents and data breaches; liaise with data protection authorities.
• Shape ICT and security for Swedish credit institution licence.
• Respond to client security and privacy due diligence.
• Run security and privacy awareness for staff.

Skills

InfoSec GRC

Data protection

ISMS implementation

GDPR/UK GDPR

DORA familiarity

Cloud security

Writing skills

Independent judgement

Job description

Two is seeking an Information Security Officer to drive our cyber and data protection programme. You'll own how Two governs information security and personal data across the group, setting standards, managing risk, and proving compliance to regulators, clients and auditors.

This hands-on, high-ownership role works with our CTO, senior leadership and engineering teams, influencing how a growing fintech builds security and privacy into every product.