This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Information Security Lead based in Portugal.
This is a senior information security and GRC leadership opportunity within a fast-growing, remote-first technology environment.
You will take ownership of the quality, depth, and evolution of a multi-framework compliance offering supporting modern businesses across Europe.
The role combines hands-on security and compliance delivery with team leadership, customer engagement, and strategic roadmap ownership.
You will work across frameworks including ISO 27001, SOC 2, GDPR, TISAX, NIS 2, DORA, and other emerging standards.
Your expertise will directly influence customer outcomes, audit readiness, compliance content, and the development of security-focused product capabilities.
You will collaborate closely with customers, auditors, product and engineering teams, customer success, sales, and senior leadership.
The position offers significant autonomy and impact for an experienced security professional who enjoys building scalable processes and turning complex requirements into practical solutions.
Accountabilities
- Own and drive the compliance roadmap across multiple frameworks, including ISO 27001, TISAX, SOC 2, GDPR, NIS 2, DORA, ISO 27017/27018, ISO 42001, C5, and additional frameworks as the offering expands.
- Lead end-to-end ISO 27001 implementation and related compliance projects for customers.
- Mentor, coach, and upskill compliance specialists by sharing expertise, reviewing work, and promoting consistency across audits and customer deliverables.
- Conduct internal audits for strategic and complex customers and review audits completed by junior team members to maintain high standards of quality.
- Act as a senior compliance partner for customer success and sales teams, providing timely guidance on complex customer questions and participating in customer calls when specialist expertise is required.
- Own and continuously improve compliance content, including policies, evidence templates, compliance playbooks, security awareness training, and related resources.
- Identify framework gaps and incorporate auditor feedback into internal processes, team practices, and platform improvements.
- Partner with product and engineering teams to translate compliance requirements and gaps into clearly defined product initiatives.
- Collaborate with customer success, product, and senior leadership to align compliance priorities with customer needs and business objectives.
- Strengthen relationships with certification partners and support auditor enablement by helping them understand and effectively use the compliance platform during customer audits.
- Bring a strong ownership mindset to ambiguous initiatives, independently defining priorities, translating them into actionable plans, and driving execution.
Requirements
- 7+ years of hands-on experience in information security and GRC, ideally within a B2B SaaS environment.
- Fluent English proficiency, both written and spoken.
- Proven experience leading at least 5 successful ISO 27001 certification projects as an implementer, auditor, or both, preferably within startup or mid-market environments.
- At least 2 years of experience managing or leading people and teams.
- Hands-on experience using a GRC platform or comparable security and compliance management tools.
- Strong understanding of cloud infrastructure across AWS, Azure, and GCP, including security posture analysis and remediation planning.
- Excellent project management skills, with the ability to turn ambiguous initiatives into concrete deliverables, prioritize effectively, and drive projects through to completion.
- Exceptional written communication skills, particularly the ability to create clear and precise compliance content for diverse audiences including auditors, founders, engineers, and customers.
- Strong ownership and execution mindset, with the ability to operate independently as a senior individual contributor without waiting for detailed direction.
- Strong stakeholder management and communication skills, with the confidence to work across technical, commercial, and leadership teams.
- Experience implementing additional frameworks such as SOC 2, GDPR, NIS 2, or similar standards is a plus.
- Experience mentoring or coaching colleagues in compliance, audit, information security, or GRC is advantageous.
- Previous experience working in a startup or high-growth technology company is beneficial.
Benefits
- 100% remote working environment with a virtual office designed to support team collaboration.
- Competitive local salary, with compensation positioned at or above relevant market rates.
- Generous equity package, providing employees with an opportunity to share in the company's success.
- Access to experienced mentors and a strong professional network.
- €1,000 annual personal development budget.
- Home office budget and access to co-working spaces.
- 26 days of annual vacation plus local public holidays.
- Comprehensive health insurance coverage.
- Annual company retreat to build relationships and exchange ideas.
- Company-wide events and opportunities to connect with colleagues.
- Latest technology and equipment, including laptop, monitors, and headphones.
- Remote-first culture with a strong emphasis on collaboration, communication, and team connection.
- Opportunity to make a meaningful impact on security, compliance, customer outcomes, and product development within a growing European technology business.
How Jobgether works:
We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.
We appreciate your interest and wish you the best!
Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.
#LI-CL1
