Information Security Lead

Aspora; United States; On-site; USD 100,000 - 145,000; Full time

Job summary

Aspora seeks a senior security leader to own ICT risk and regulatory assurance for its EU entity. You will oversee the risk framework, certification programs, and regulatory relationships, coordinating with Infrastructure, DevOps, and Engineering leadership.

The role offers growth into senior security leadership as Aspora expands. You will drive incident response, DPIAs, breach notifications, and audit evidence while aligning engineering tickets to the regulatory needs.

Qualifications

• Experience in regulated financial services.
• Ownership of certification cycles (ISO 27001, PCI-DSS, SOC 2).
• Ability to read AWS controls and vulnerability scans for technical discussions.
• Demonstrated incident response and DR/BCP drills.
• Bilingual in Lithuanian and English, with regulator-facing excellence.

Responsibilities

• Build and run ICT risk framework and regulatory assurance for the EU entity.
• Manage certification programmes to consolidate evidence across jurisdictions.
• Lead incident response, regulatory notifications, and post-incident follow-through.

Skills

Regulatory security leadership

ISO 27001

SOC 2

PCI-DSS

Incident response

Job description

About Aspora

People on the move deserve a bank that moves with them. Since 2022, Aspora has been building a borderless financial operating system that makes money as mobile and transparent as its users.

Backed by influential venture capitalists like Sequoia Capital, Greylock Partners, Hummingbird Ventures, Y Combinator & Global Founders Capital. We're a team of 150+ across India, the UK, the UAE, EU and the US, working with extreme ownership, radical candour, and an obsession with customer impact.

We celebrate builders who question assumptions, ship fast, and turn regulatory complexity into elegant solutions. If you’re driven to redefine what global banking can be, we’d love to build the future with you.

About the Role

Aspora moves money between the EU, the UK, the UAE and India. Every corridor runs on licences, partner banks and regulators who expect security to be proven, not promised. This role is the named local owner of ICT risk, information security and IT for our EU entity — the person responsible for making our security posture provable to any regulator, auditor or partner bank, on demand.
You will own the ICT risk framework, the regulatory relationship and the certification programme, working daily with Infrastructure, DevOps and the Head of Engineering, reporting to our COO. The role is built to grow into our senior security leadership seat.

Who You Are

• You've worked in regulated financial services. You've run information security or ICT risk inside a bank, EMI, payment institution or fintech, and you've sat across from the regulator during inspections or incident notifications.
• You've closed a certification cycle. You've owned or materially run ISO 27001, SOC 2 or PCI-DSS end to end — from scoping through evidence to closing the findings.
• You speak engineer. You can read AWS access controls and a vulnerability scan, triage what matters, and have a credible technical conversation with the people who fix it.
• You've led the response. You've run incident response and DR drills hands-on, made regulatory notification calls under pressure, and stayed accountable through the post-incident fix.
• You work in Lithuanian and English. You can represent the entity to the Bank of Lithuania and partner banks in both languages, in writing and in the room.

Most importantly, you want to own the whole picture: the framework, the regulator, the certification and the engineering follow-through, for a cross-border bank that is still being built.

What You'll Own

• ICT risk and regulatory assurance. Build and run the DORA risk framework, policies, risk register and third-party register. Represent the EU entity to the Bank of Lithuania, auditors and partner banks on every IT and security matter, and close findings before they age.
• Certifications. Run the group ISO 27001 and PCI-DSS programme for the EU entity so one body of evidence serves every jurisdiction.
• Incident response and data protection. Own the incident-response playbook including the regulatory notification path, run DR and BCP drills, and be the technical counterpart to the DPO on DPIAs, transfer assessments and breach notifications.
• Engineering follow-through. Convert audit and regulatory requirements into engineering tickets with owners and dates, and follow every one to closure.
• Entity IT. Own devices, identity and access, SaaS tooling and joiner/mover/leaver for EU staff.

Why Aspora

• Define what provable security looks like for a cross-border bank — and set the standard every future entity inherits.
• Work directly with our COO and Head of Engineering, with the authority to set the bar and the support to hold it.
• Own the EU entity's regulatory relationship on security from day one, with room to grow the function as Aspora grows.
• Competitive salary, comprehensive benefits, and ESOPs aligned with Aspora's long-term vision.

Location

Vilnius, Lithuania