IT Operations Lead

Modaxo; Lisboa; Hybrid; EUR 90,000 - 140,000; Full time

Job summary

Modaxo is seeking an Information Security Lead to drive governance, risk, and compliance across its EMEA/Asia portfolio. You will lead a small team of security analysts and engineers, overseeing ISO 27001 readiness and data protection initiatives while communicating risk to senior executives.

The role is remote in Portugal with some travel, and Modaxo supports a hybrid/remote policy. You will shape security standards, manage audits, and partner with business units to mature security practices

Qualifications

• Proven information security leadership across multi-entity groups.
• Knowledge of ISO 27001, NIST CSF, CIS Controls, SOC 2.
• Experience translating risk into business language.

Responsibilities

• Establish and improve security governance across business units.
• Oversee ISO 27001 certification efforts and GDPR compliance.
• Lead a small security team and drive risk-based security posture.
• Engage with senior stakeholders to report on risk and maturity.
• Support incident response, business continuity and disaster recovery.

Skills

Security governance

Risk management

Stakeholder management

Team leadership

Education

ISO 27001 Lead Implementer/Lead Auditor (certification)

Tools

SIEM

GRC tooling

Vulnerability management

Job description

IT Operations Lead### IT Operations LeadApply: Lisbon: Full time: Posted 2 Days Ago: R58073**Job Summary:**About Modaxo Modaxo is a global collective of technology companies that helps people move around their communities. With more than 50 companies representing 34 brands, Modaxo comprises 5,000 people, operating in 37 countries around the world, all focused on People Transportation. As an employer we are committed to cultivating a friendly and exciting working environment, with a huge emphasis on employee engagement. We can offer the sense of social community often associated with a small, local business, combined with the expected advantages of working for a far larger employer: great benefits, dedication to identifying talent, and persistent investment in staff development. Modaxo seeks to grow every business we own and, further, to add several new acquisitions to the collective every year. We are a ‘buy and hold forever’ investor, meaning that our collective grows in scale, complexity and interest every year. “Modaxo’s expertise, global bench strength, and singular focus on People Transportation make it a great home for technology companies that share our vision to efficiently move the world’s people.” Bill Delaney, CEO, Modaxo**Job Description:****About the Role**Are you a security leader who enjoys bringing structure, consistency and pragmatism to complex, multi-entity organisations? Modaxo is looking for an Information Security Lead to drive security governance and best-practice implementation across our EMEA/Asia portfolio of 2 groups, 5 sub-groups and around 30 business units, serving approximately 4,000 users. You will lead a small team of security analysts and engineers, oversee compliance across the portfolio and guide business units through their ISO 27001 journeys. This role suits someone who can set direction at portfolio level while rolling up their sleeves to help individual businesses mature. **This is remote role based in Portugal. Some travel required.** You will own a consistent, risk-based security posture across a decentralised environment. You will influence senior stakeholders, translate technical risk into clear business language, and build a team that keeps pace with an evolving threat landscape. **Areas of Responsibility****Security Governance and Risk*** Establish and continuously improve the security governance framework across all business units.* Define and enforce policies and standards aligned to group requirements, ISO 27001, NIST and CIS Controls.* Maintain a portfolio-wide risk register, ensuring risks are escalated and remediated in good time.* Report risk posture and compliance status to Group Security Leadership, General Managers and Risk Committees.**Compliance and ISO 27001 Certification*** Be the go-to expert guiding business units through gap assessments, ISMS build-out and certification cycles.* Oversee compliance with GDPR, UK GDPR, the Data Protection Act, sector rules and customer security clauses.* Manage internal and external audits, coordinating evidence collection and remediation.* Ensure third-party and vendor security risk assessments are completed where relevant.**Security Best Practice and Resilience*** Champion secure baselines, vulnerability management, identity and access management, and data protection.* Embed security by design with IT and business unit leaders, standardising tooling where feasible.* Provide senior input into incident response, with lessons learned feeding back into controls.* Support business continuity and disaster recovery planning from a security perspective.**Team Leadership*** Lead, mentor and develop a small team of security analysts and engineers.* Prioritise resources across governance, compliance, incident response and business unit support.* Grow team capability in line with the evolving threat landscape and regulatory requirements.* Track and report maturity improvement initiatives across the portfolio. **Profile**You are a pragmatic security leader who brings order to complex, multi-entity environments and earns trust with business leaders. You combine deep ISO 27001 expertise with the influence to drive change without direct authority.* Proven information security leadership experience, ideally in a multi-entity, decentralised or M&A-driven group.* Strong working knowledge of ISO 27001, including implementation and certification support.* Familiarity with NIST CSF, CIS Controls and SOC 2.* Track record of running security governance and compliance programmes across multiple business units.* Solid understanding of UK and EMEA regulation, including GDPR, UK GDPR and the Data Protection Act.* Excellent stakeholder and communication skills, able to translate technical risk for senior audiences. **About You**You are credible, collaborative and hands-on, comfortable setting portfolio-level direction while helping individual businesses improve. CISSP, CISM, CISA or ISO 27001 Lead Implementer or Lead Auditor certification is a plus, as is experience in a software or technology holding company and hands-on exposure to SIEM, vulnerability management and GRC tooling. **Practical**This role covers business units across the UK, EMEA and Asia, and periodic travel to business unit sites may be required. We operate a hybrid/remote working model in line with Modaxo policy. Modaxo is committed to building a diverse and inclusive workplace and welcomes applications from all qualified candidates.**Worker Type:**Regular**Number of Openings Available:**1