Information Security Lead

About the role

Aspora is a fintech building a borderless financial operating system, moving money between the EU, the UK, the UAE and India. Its EU entity needs a named local owner of ICT risk, information security and IT, responsible for proving its security posture to regulators, auditors and partner banks on demand. The role reports to the COO and works daily with Infrastructure, DevOps and the Head of Engineering, and is designed to grow into a senior security leadership seat.

Key responsibilities

• Build and run the DORA risk framework, policies, risk register and third-party register, and represent the EU entity to the Bank of Lithuania, auditors and partner banks
• Run the group ISO 27001 and PCI-DSS programme for the EU entity
• Own the incident-response playbook, including the regulatory notification path, and run DR and BCP drills
• Act as technical counterpart to the DPO on DPIAs, transfer assessments and breach notifications
• Turn audit and regulatory requirements into engineering tickets with owners and dates, and follow them to closure
• Own devices, identity and access, SaaS tooling and joiner/mover/leaver for EU staff

Required profile

• Experience in regulated financial services, running information security or ICT risk in a bank, EMI, payment institution or fintech
• Has closed a certification cycle, owning ISO 27001, SOC 2 or PCI-DSS end to end
• Incident response and DR drill experience, including regulatory notification calls
• Lithuanian and English, able to represent the entity to the Bank of Lithuania and partner banks

Required skills

• Reading AWS access controls and vulnerability scans
• DORA risk framework and ISO 27001 / PCI-DSS

What we offer

• Competitive salary and comprehensive benefits
• ESOPs aligned with the company's long-term vision