Head of Information Security & Privacy (Fintech)

Two AS; United Kingdom; Remote; GBP 90,000 - 130,000; Full time

Job summary

Two is seeking an Information Security Officer to drive cyber and data protection across the group. You will own governance, set standards, manage risk, and demonstrate compliance to regulators, clients and auditors. This is a hands‑on, high‑ownership role shaping security in a growing fintech.

You will collaborate with the CTO, leadership and engineering teams to embed security and privacy into everything the company does, including future licensing work in the UK and EU.

Qualifications

• Solid experience in information security GRC and/or data protection, ideally in fintech, payments or financial services.
• Practical experience building or running an ISMS (ISO 27001, SOC 2 or similar).
• Strong working knowledge of GDPR / UK GDPR — not just the theory, but how to make it work day to day.
• Familiarity with DORA or EBA ICT risk guidelines.
• Enough technical depth in cloud environments (GCP a plus) to challenge engineers credibly.
• Clear, sharp writing — equally at home drafting a regulator letter, a board update or a Slack message.
• The confidence to work independently and the judgement to focus on what genuinely reduces risk.

Responsibilities

• Own and evolve our ISMS and security policy framework, aligned to ISO 27001 and DORA
• Run cyber and information risk management, from risk assessments to board‑level reporting
• Lead third‑party and ICT supplier risk — tiering, due diligence, DPAs and ongoing review
• Lead our EEA‑EU GDPR / UK GDPR programme: records of processing, DPIAs, privacy notices, data subject requests and international transfers
• Assess incidents and personal data breaches, and act as our point of contact with data protection authorities
• Shape the ICT and security side of our Swedish credit institution licence
• Answer client security and privacy due diligence with confidence
• Run our security and privacy awareness programme for all staff

Skills

Information security GRC

Data protection

ISMS design & operation

Regulatory reporting

Policy writing

Education

CISSP, CISM, CISA, ISO 27001 Lead Implementer/Auditor, CIPP/E or CIPM

Tools

GCP / cloud security

DORA / EBA ICT risk guidelines

GDPR implementation

Job description

Two is seeking an Information Security Officer to drive cyber and data protection across the group. You will own governance, set standards, manage risk, and demonstrate compliance to regulators, clients and auditors. This is a hands‑on, high‑ownership role shaping security in a growing fintech.

You will collaborate with the CTO, leadership and engineering teams to embed security and privacy into everything the company does, including future licensing work in the UK and EU.