Information Security Lead

Modaxo; Portugal; Remote; EUR 90,000 - 120,000; Full time

Job summary

Modaxo is seeking an Information Security Lead to drive governance, risk management and ISO 27001 initiatives across its EMEA/Asia portfolio, serving thousands of users. You will lead a team of security professionals, guide business units through compliance journeys, and influence senior stakeholders while maintaining a pragmatic security posture across a decentralised environment.

You will translate complex risk into clear business language, establish baselines, collaborate with IT and business

Qualifications

• Proven information security leadership experience across multiple entities
• Strong working knowledge of ISO 27001 including implementation and certification support
• Familiarity with NIST CSF, CIS Controls and SOC 2
• Track record of running security governance and compliance programmes across multiple business units
• Solid understanding of UK and EMEA regulation including GDPR and the Data Protection Act
• Excellent stakeholder and communication skills translating risk to senior audiences

Responsibilities

• Establish and continuously improve the security governance framework across all business units
• Define and enforce policies and standards aligned to group requirements, ISO 27001, NIST and CIS Controls
• Maintain a portfolio-wide risk register and ensure timely remediation of risks
• Report risk posture and compliance status to Group Security Leadership and Risk Committees
• Oversee GDPR/UK GDPR compliance and third-party security risk assessments
• Lead, mentor and develop a small team of security analysts and engineers

Skills

Security leadership

ISO 27001 expertise

Stakeholder management

Risk governance

Security governance

Education

CISSP

ISO 27001 Lead Implementer

CISM

Tools

SIEM

Vulnerability management

GRC tooling

Job description

Modaxo is a global collective of technology companies that helps people move around their communities. With more than 50 companies representing 34 brands, Modaxo comprises 5,000 people, operating in 37 countries around the world, all focused on People Transportation.

As an employer we are committed to cultivating a friendly and exciting working environment, with a huge emphasis on employee engagement. We can offer the sense of social community often associated with a small, local business, combined with the expected advantages of working for a far larger employer: great benefits, dedication to identifying talent, and persistent investment in staff development.

Modaxo seeks to grow every business we own and, further, to add several new acquisitions to the collective every year. We are a ‘buy and hold forever’ investor, meaning that our collective grows in scale, complexity and interest every year.

"Modaxo’s expertise, global bench strength, and singular focus on People Transportation make it a great home for technology companies that share our vision to efficiently move the world’s people."

Bill Delaney, CEO, Modaxo

About the Role

Are you a security leader who enjoys bringing structure, consistency and pragmatism to complex, multi-entity organisations?

Modaxo is looking for an Information Security Lead to drive security governance and best-practice implementation across our EMEA/Asia portfolio of 2 groups, 5 sub-groups and around 30 business units, serving approximately 4,000 users.

You will lead a small team of security analysts and engineers, oversee compliance across the portfolio and guide business units through their ISO 27001 journeys. This role suits someone who can set direction at portfolio level while rolling up their sleeves to help individual businesses mature.

This is remote role based in Portugal. Some travel required.

Job Summary

You will own a consistent, risk-based security posture across a decentralised environment. You will influence senior stakeholders, translate technical risk into clear business language, and build a team that keeps pace with an evolving threat landscape.

Areas of Responsibility

Security Governance and Risk

• Establish and continuously improve the security governance framework across all business units.
• Define and enforce policies and standards aligned to group requirements, ISO 27001, NIST and CIS Controls.
• Maintain a portfolio-wide risk register, ensuring risks are escalated and remediated in good time.
• Report risk posture and compliance status to Group Security Leadership, General Managers and Risk Committees.

Compliance and ISO 27001 Certification

• Be the go-to expert guiding business units through gap assessments, ISMS build-out and certification cycles.
• Oversee compliance with GDPR, UK GDPR, the Data Protection Act, sector rules and customer security clauses.
• Manage internal and external audits, coordinating evidence collection and remediation.
• Ensure third-party and vendor security risk assessments are completed where relevant.

Security Best Practice and Resilience

• Champion secure baselines, vulnerability management, identity and access management, and data protection.
• Embed security by design with IT and business unit leaders, standardising tooling where feasible.
• Provide senior input into incident response, with lessons learned feeding back into controls.
• Support business continuity and disaster recovery planning from a security perspective.
• Lead, mentor and develop a small team of security analysts and engineers.
• Prioritise resources across governance, compliance, incident response and business unit support.
• Grow team capability in line with the evolving threat landscape and regulatory requirements.
• Track and report maturity improvement initiatives across the portfolio.

Profile

You are a pragmatic security leader who brings order to complex, multi-entity environments and earns trust with business leaders. You combine deep ISO 27001 expertise with the influence to drive change without direct authority.

• Proven information security leadership experience, ideally in a multi-entity, decentralised or M&A-driven group.
• Strong working knowledge of ISO 27001, including implementation and certification support.
• Familiarity with NIST CSF, CIS Controls and SOC 2.
• Track record of running security governance and compliance programmes across multiple business units.
• Solid understanding of UK and EMEA regulation, including GDPR, UK GDPR and the Data Protection Act.
• Excellent stakeholder and communication skills, able to translate technical risk for senior audiences.

About You

You are credible, collaborative and hands-on, comfortable setting portfolio-level direction while helping individual businesses improve. CISSP, CISM, CISA or ISO 27001 Lead Implementer or Lead Auditor certification is a plus, as is experience in a software or technology holding company and hands-on exposure to SIEM, vulnerability management and GRC tooling.

Practical

This role covers business units across the UK, EMEA and Asia, and periodic travel to business unit sites may be required. We operate a hybrid/remote working model in line with Modaxo policy.

Modaxo is committed to building a diverse and inclusive workplace and welcomes applications from all qualified candidates.