Security Architect

Capital.com; Warszawa; On-site; PLN 240,000 - 420,000; Full time

Benefits offered by this job

Competitive Salary

Work-Life Harmony

Generous Time Off

Employee Referral Program

Comprehensive Health & PensionBenefits

Workation

Volunteer Days

Job summary

Capital.com is a global fintech company with over 1,000,000 clients worldwide. We are seeking a Security Architect to own the enterprise GRC framework across five regulated jurisdictions, shaping how we measure and reduce security risk and ensuring regulatory readiness.

This senior role combines security architecture, regulatory compliance, and executive risk advisory. Fluent English is essential, and a proven track record in regulated financial services will help you thrive in our fast‑paced,

Qualifications

• 8+ years in security with focus on GRC, regulatory compliance, risk management.
• Experience designing enterprise security architectures in regulated financial services.
• Deep command of ISO 27001 and PCI-DSS; working knowledge of DORA and NIS2.
• Multi-jurisdiction compliance experience; FCA or CySEC exposure a strong advantage.
• Fluent English, written and spoken.

Responsibilities

• Own the enterprise security GRC framework — policy hierarchy, risk register methodology, control ownership, and audit evidence structure.
• Map controls to DORA, NIS2, ISO 27001, and PCI-DSS, identify gaps, and set remediation priority.
• Act as the final authority on regulatory interpretation affecting security, including written positions for audits and regulatory submissions.
• Own the compliance and obligation management framework across all five regulated jurisdictions (FCA, CySEC, ASIC, SCB, SCA), including regulatory horizon scanning.
• Represent the company in regulatory discussions alongside the CISO and General Counsel where required.
• Define the company's human-risk philosophy and shape the security awareness architecture— segmentation, interventions, and measurement.
• Advise the CISO, CHRO, Risk, and Compliance teams on security risk, regulatory obligations, and investment trade-offs.
• Set the architectural standards the Corporate Security team executes against, and sign off on significant framework changes.
• Support Third-Party Risk Management and Business Continuity & Crisis Management from a security and technical perspective.

Skills

GRC

Regulatory compliance

Security architecture

ISO 27001

PCI-DSS

DORA

NIS2

Regulatory submissions

C-suite influence

English proficiency

Education

CISSP

CISM

CRISC

Job description

Capital.com is a global fintech company with over 1,000,000 clients worldwide. Our platform offersCFD trading across 5,000+ markets, powered by proprietary AI technology that helps traders makebetter decisions.Our top-rated products have won prestigious industry awards for their cutting-edge technology andseamless client experience. We deliver only the best, so we are always in search of the best people tojoin our ever-growing talented team.

As part of our continued investment in security and regulatory resilience, we are seeking aSecurity Architect to own the design of our enterprise security governance, risk, and compliance(GRC) framework. This is a senior, high-visibility role that sits at the intersection of securityarchitecture, multi-jurisdiction regulatory compliance, and organizational risk — shaping how a globalfintech company regulated across five jurisdictions thinks about, measures, and reduces security risk.

Responsibilities

• Own the enterprise security GRC framework — policy hierarchy, risk register methodology,control ownership, and audit evidence structure.
• Map controls to DORA, NIS2, ISO 27001, and PCI-DSS, identify gaps, and set remediationpriority.
• Act as the final authority on regulatory interpretation affecting security, including writtenpositions for audits and regulatory submissions.
• Own the compliance and obligation management framework across all five regulated jurisdictions (FCA, CySEC, ASIC, SCB, SCA), including regulatory horizon scanning.
• Represent the company in regulatory discussions alongside the CISO and General Counselwhere required.
• Define the company's human-risk philosophy and shape the security awareness architecture— segmentation, interventions, and measurement.
• Advise the CISO, CHRO, Risk, and Compliance teams on security risk, regulatory obligations,and investment trade-offs.
• Set the architectural standards the Corporate Security team executes against, and sign off onsignificant framework changes.
• Support Third-Party Risk Management and Business Continuity & Crisis Management from asecurity and technical perspective.

Requirements

• 8+ years in security with a significant focus on GRC, regulatory compliance, riskmanagement, or a combination — with a track record of owning these programs at enterpriselevel, not just familiarity with them.
• Proven experience designing enterprise-level security architectures or frameworks;experience in a regulated financial services environment (brokerage, payments, banking, orequivalent) is preferred but not required.
• Deep command of ISO 27001 and PCI-DSS (working knowledge of DORA and NIS2preferred), with the ability to translate regulatory text into specific controls, identify gaps, anddetermine what is mandatory versus discretionary.
• Multi-jurisdiction compliance experience; direct exposure to FCA or CySEC is a strongadvantage.
• Demonstrated ability to advise and influence C-suite stakeholders on complex security andregulatory matters.
• A structured, analytical thinking style — able to hold multiple regulatory regimessimultaneously without losing precision on any of them.
• Fluent English, written and spoken.

Nice to have

• Direct experience managing regulatory submissions or engaging with supervisory authorities(FCA, CySEC, ASIC, SCB, or SCA).
• TPRM program design experience, including DORA ICT third-party risk requirements andsupply chain risk.
• Business Continuity Management background, with experience meeting operational resilienceobligations and presenting at Board level.
• Security awareness program design with measurable behaviour-change outcomes.
• Experience building or scaling a Corporate Security function from an early stage.
• Relevant professional certifications (CISSP, CISM, CRISC, or equivalent).

What you will get in return

Competitive Salary:We believe great work deserves great pay! Your skills and talents will be rewarded with a salary that makes you feel valued and motivated.

Work-Life Harmony:Join a company that genuinely cares about you - because your life outside of work matters just as much as your time on the clock. #LI-Hybrid

Generous Time Off:Need a breather? Our annual leave policy lets you recharge and enjoy life outside of work without a worry.

Employee Referral Program:Love working here? Share the love! Bring your talented friends on board and get rewarded for growing our awesome team.

Comprehensive Health & Pension Benefits:From medical insurance to pension plans, we've got your back. Plus, location-specific benefits and perks!

Workation Wonderland:Live your digital nomad dreams with 30 extra days to work remotely from anywhere in the world (some restrictions apply). Adventure awaits!

Volunteer Days:Make a difference! Take two additional paid days each year to support causes you care about and give back to the community.

Be a key player at the forefront of the digital assets movement, propelling your career to new heights!Join a dynamic and rapidly expanding company that values and rewards talent, initiative, and creativity.Work alongside one of the most brilliant teams in the industry.