Aspora - Information Security Lead

• — You've worked in regulated financial services. You've run information security or ICT risk inside a bank, EMI, payment institution or fintech, and you've sat across from the regulator during inspections or incident notifications.— You've closed a certification cycle. You've owned or materially run ISO 27001, SOC 2 or PCI-DSS end to end — from scoping through evidence to closing the findings.— You speak engineer. You can read AWS access controls and a vulnerability scan, triage what matters, and have a credible technical conversation with the people who fix it.— You've led the response. You've run incident response and DR drills hands-on, made regulatory notification calls under pressure, and stayed accountable through the post-incident fix.— You work in Lithuanian and English. You can represent the entity to the Bank of Lithuania and partner banks in both languages, in writing and in the room.Most importantly, you want to own the whole picture: the framework, the regulator, the certification and the engineering follow-through, for a cross-border bank that is still being built.What You'll Own • You've worked in regulated financial services. • You've closed a certification cycle. • You speak engineer. • You've led the response. • You work in Lithuanian and English. • What You'll Own • — ICT risk and regulatory assurance. Build and run the DORA risk framework, policies, risk register and third-party register. Represent the EU entity to the Bank of Lithuania, auditors and partner banks on every IT and security matter, and close findings before they age.— Certifications. Run the group ISO 27001 and PCI-DSS programme for the EU entity so one body of evidence serves every jurisdiction.— Incident response and data protection. Own the incident-response playbook including the regulatory notification path, run DR and BCP drills, and be the technical counterpart to the DPO on DPIAs, transfer assessments and breach notifications.— Engineering follow-through. Convert audit and regulatory requirements into engineering tickets with owners and dates, and follow every one to closure.— Entity IT. Own devices, identity and access, SaaS tooling and joiner/mover/leaver for EU staff. • ICT risk and regulatory assurance. • Certifications. • Incident response and data protection. • Engineering follow-through. • Entity IT.