Senior Information Security Officer

About the role

EPPC Albania is recruiting, on behalf of a fintech client operating in digital financial services and electronic payments, a Senior Information Security Officer based in Tirana. The role establishes and maintains the company's information security framework, ensures regulatory compliance, protects information assets and provides independent oversight of cybersecurity risks, controls and security governance.

Key responsibilities

• Establish and maintain the information security framework, policies, procedures and security governance in line with ISO 27001.
• Define security controls for mobile applications, cloud infrastructure and critical systems and oversee their technical implementation by the IT team.
• Identify, assess and monitor information security risks, vulnerabilities and remediation actions.
• Ensure compliance with applicable information security and cybersecurity regulatory requirements.
• Develop and maintain incident response procedures, oversee incident handling, escalation and corrective actions.
• Oversee the information security aspects of business continuity, disaster recovery and backup processes, including periodic testing.
• Report security risks, control effectiveness and improvement priorities to senior management.
• Take ownership of developing the information security function, working with IT and external audit support.
• Coordinate security awareness and training across the organisation.
• Review user access rights, privileged access and segregation of duties.
• Assess security risks related to external vendors, service providers and outsourcing arrangements.
• Evaluate security requirements for new digital products, applications and technology initiatives from the design stage.

Required profile

• At least 3 years of relevant experience in information security, IT security or IT audit, preferably in banking, financial institutions or fintech.
• Proven ability to define security policies, procedures, risk assessments and controls and oversee their technical implementation.
• Good understanding of financial-sector regulatory requirements and IT security controls.
• Hands-on, proactive and independent approach, with strong ownership, analytical and stakeholder management skills.

Required skills

• Strong, practical knowledge of ISO 27001 and information security governance frameworks (mandatory).
• Proven knowledge of mobile application security and cloud infrastructure security (mandatory).

To apply, candidates submit their CV through the EPPC Albania application link; they will be contacted only if the CV is qualified.