SalariesSign in
AboutPrivacyTerms
Information Security Lead
emerchantpay

Information Security Lead

BulgariaRemoteFull-time
Posted Oct 2
Apply

Job Description

emerchantpay is a leading global payment service provider and acquirer for online, mobile, in-store and over the phone payments. Our global payments solution is available through a simple integration, offering a diverse range of features, including global acquiring, global and local payment methods, advanced fraud management and performance optimisation. We empower businesses to design seamless and engaging payment experiences for their consumers.

We are looking for an experienced Information Security Lead to own the design, implementation, and continuous improvement of information security across our cloud-native, DevOps-driven engineering environment, as well as our corporate IT and office infrastructure.

The role combines hands-on technical delivery with security leadership. The Information Security Lead will set security direction and personally drive its execution - securing our cloud platform, delivery pipelines, and microservices, leading security operations and incident response, and embedding security into how engineering builds and ships.

The role works closely with Engineering, DevOps, and the IT Governance, Risk & Compliance (GRC) function.

The role has a strong focus on AWS and cloud-native security across a modern microservices architecture.

Responsibilities

  • Define and maintain the information security strategy, standards, and roadmap, aligned to applicable regulations, rules, and security best practices.
  • Steer security architecture across a cloud-native environment, defining secure-by-design patterns for microservices, APIs, and shared platform services.
  • Establish and govern secure software development lifecycle (secure SDLC) practices, embedding automated security controls into CI/CD pipelines.
  • Define and drive adoption of cloud security guardrails - identity, network segmentation, encryption, secrets management, and configuration baselines.
  • Build and run security monitoring, logging, and threat detection across cloud, infrastructure, and application layers.
  • Lead the security incident response lifecycle - preparation, detection, containment, eradication, recovery, and post-incident review - and act as incident commander for security events.
  • Own vulnerability and threat management: scanning, risk-based prioritization, remediation tracking, and reporting across infrastructure, containers, and application code.
  • Plan and coordinate penetration testing and offensive-security exercises (in-house or co-sourced) and drive findings to closure.
  • Govern identity and access management, privileged access, and least-privilege principles across cloud and corporate systems.
  • Define and oversee data protection controls - encryption, key management, data classification, and loss prevention - for sensitive and cardholder data.
  • Secure corporate IT and office infrastructure, including endpoints, networks, and productivity and collaboration platforms.
  • Partner with Engineering and DevOps teams to make the secure path the easy path, providing tooling, standards, threat modelling, and design reviews.
  • Provide security input into architecture and change decisions, including the adoption of new technologies and third-party services.
  • Run security awareness and phishing-resilience programs for technical and non-technical staff.
  • Implement and evidence the technical security controls underpinning PCI DSS, ISO 27001, and SOC audits.
  • Monitor the evolving threat landscape and emerging security technologies.
  • Act as a key member of the internal security center of excellence and contribute to cross-functional security working groups.
  • Build, lead, and mentor a small security team.
  • Report security posture, key risks, and metrics.

Requirements

  • Bachelor’s or master’s degree in computer science, information security, or a related field, or equivalent practical experience.
  • At least 10 years in information / cyber security, including a minimum of 2-3 years in a leadership role, with hands-on experience securing cloud-native environments at scale.
  • Deep, practical public-cloud security knowledge (AWS strongly preferred): identity, networking, encryption, logging, and configuration management.
  • Strong experience securing DevOps / CI/CD pipelines and modern microservices architectures - containers, APIs, and infrastructure-as-code.
  • Working knowledge of application security and secure SDLC across modern programming languages and web frameworks.
  • Hands-on experience with security operations, incident response, and vulnerability management.
  • Solid understanding of security frameworks and compliance standards relevant to payments: ISO 27001, PCI DSS, SOC 2, and NIST CSF.
  • Working AI security literacy, with hands-on use of AI-assisted security tooling (e.g., GenAI coding assistants, AI-augmented SAST/DAST and SIEM/SOC analytics) and a practical understanding of securing AI/LLM and agentic applications, including AWS AI services such as Amazon Bedrock and the OWASP Top 10 risks for LLMs (e.g., prompt injection and data leakage).
  • Strong analytical and problem-solving ability, with high integrity and sound judgement.
  • Excellent verbal and written communication skills, fluent English, and the ability to influence engineers with data, logic, and best practices.

Considered as an Advantage

  • Professional certification such as CISSP, CCSP, OSCP, AWS Security Specialty, or CISM.
  • Experience in a payments, fintech, banking, or other regulated environment.
  • Familiarity with operational-resilience expectations (e.g. DORA-style requirements).
  • Experience standing up a security function.

Benefits

  • Fast-growing payment company;
  • Excellent working conditions, casual atmosphere, and state-of-the-art hardware;
  • Modern, challenging, constantly growing business;
  • Professional development - books, trainings, certifications, etc.;
  • Team buildings and fun activities;
  • 25 days paid holiday, 1 day for every 2 years with us;
  • Fully distributed and remote.

If you are interested, please apply with your CV in English only. Only short-listed candidates will be contacted.

Personal data of the applicants will be processed in strict confidentiality by emerchantpay ltd. UIC 175117520 solely for the purposes of selection and recruitment and will not be transferred to other data controllers unless required by law. Applicants provide their personal data on a voluntary basis and will have the right to access and correct their personal data within a reasonable time upon filing a written request.

emerchantpay is an equal opportunity employer. We appreciate people with different backgrounds and mindsets, and we honor diversity and inclusion.

Originally posted on Himalayas

View job

Red Team Security Engineer

Backblaze

  • Colombia
  • Remote
  • Full-time
Apply
9 hrs ago
View job

Information Security Analyst (Product Assurance)

Lacuna Talent

  • United States
  • Remote
  • Full-time
Apply
9 hrs ago
View job
S

Senior Cyber Security Specialist

Softtest pays pty ltd

  • Australia
  • Remote
  • Full-time
Apply
9 hrs ago
View job

OT-Security Consultant / Penetration Tester (m/w/d)

Yekta IT GmbH

  • Germany
  • Remote
  • Full-time
Apply
9 hrs ago
View job
S

Client Assurance- InfoSec GRC - Remote US

SAMC SitusAMC Holdings Corp

  • United States
  • Remote
  • Full-time
Apply
10 hrs ago
View job

Network Security Engineer - Vulnerability & Compliance Focus

Support Tech LLC

  • United States
  • Remote
  • Full-time
Apply
10 hrs ago
View job

Principal AI Research Cybersecurity Scientist (Bay Area)

Alice

  • United States
  • Remote
  • Full-time
Apply
10 hrs ago
View job

Senior Risk Analyst

Apogee Global RMS

  • United States
  • Remote
  • Contract
Apply
12 hrs ago
View job

Security Compliance Engineer

Yuno

  • Argentina
  • Remote
  • Full-time
Apply
13 hrs ago
View job

Chief Information Security Officer (CISO) — Insurance & Investments

TheHiveCareers

  • Dominican Republic
  • Remote
  • Full-time
Apply
13 hrs ago
View job

Senior Incident Response Analyst

HealthEdge

  • United States
  • Remote
  • Full-time
Apply
13 hrs ago
View job
I

SME Security Control Assessor

IMAGINEEER LLC

  • United States
  • Remote
  • Full-time
Apply
14 hrs ago
View job

Cybersecurity Analyst Intermediate w/Splunk

General Dynamics Information Technology

  • United States
  • Remote
  • Full-time
Apply
14 hrs ago
View job

Information Security Risk Specialist

Booz Allen Hamilton

  • United States
  • Remote
  • Full-time
Apply
15 hrs ago
View job

Incident Response Analyst

Check Point Software

  • Australia
  • Remote
  • Full-time
Apply
16 hrs ago
View job

Mid-Level Security Automation Engineer

DecisionPoint Corporation

  • United States
  • Remote
  • Full-time
Apply
16 hrs ago
View job

Principal Security Compliance Analyst (FedRAMP) - Remote, U.S.

Entrust

  • United States
  • Remote
  • Full-time
Apply
16 hrs ago
View job
F

Cybersecurity Analyst II

Frontgrade Technologies

  • United States
  • Remote
  • Full-time
Apply
17 hrs ago
View job

Security Operations Engineer

Collectors

  • United States
  • Remote
  • Full-time
Apply
18 hrs ago
View job

IT Security Specialist (Microsoft Azure & 365 Focus)

Support Tech LLC

  • United States
  • Remote
  • Contract
Apply
18 hrs ago
View job

Cybersecurity Program Manager

Apogee Global RMS

  • United States
  • Remote
  • Contract
Apply
18 hrs ago
View job

Director, IT & Security

Illuminate Literacy

  • United States
  • Remote
  • Full-time
Apply
19 hrs ago
View job

Senior Security Operations Engineer

Sword Health

  • United States
  • Remote
  • Full-time
Apply
19 hrs ago
View job
S

Security Software Developer

Softtest pays pty ltd

  • Australia
  • Remote
  • Full-time
Apply
21 hrs ago
View job

National Security Manager

Fujifilm

  • United States
  • Remote
Apply
22 hrs ago
View job

Manager Identity & Trust Engineering

BlueCross BlueShield of Tennessee

  • United States
  • Remote
  • Full-time
Apply
22 hrs ago
View job

Senior Product Owner DevSecOps

Humana

  • United States
  • Remote
  • Full-time
Apply
22 hrs ago
View job

Sr. Engineer, Product Cyber Security

BD

  • United States
  • Remote
  • Full-time
Apply
22 hrs ago
View job

Sr. Security/ Technology Engineer

NV5

  • United States
  • Remote
  • Full-time
Apply
23 hrs ago
View job

Cyber Security Cloud Engineer

National Carwash Solutions

  • United States
  • Remote
  • Full-time
Apply
23 hrs ago
Page 1 of 128Next
emerchantpay

Information Security Lead

BulgariaRemoteFull-time
Posted Oct 2
Apply

Job Description

emerchantpay is a leading global payment service provider and acquirer for online, mobile, in-store and over the phone payments. Our global payments solution is available through a simple integration, offering a diverse range of features, including global acquiring, global and local payment methods, advanced fraud management and performance optimisation. We empower businesses to design seamless and engaging payment experiences for their consumers.

We are looking for an experienced Information Security Lead to own the design, implementation, and continuous improvement of information security across our cloud-native, DevOps-driven engineering environment, as well as our corporate IT and office infrastructure.

The role combines hands-on technical delivery with security leadership. The Information Security Lead will set security direction and personally drive its execution - securing our cloud platform, delivery pipelines, and microservices, leading security operations and incident response, and embedding security into how engineering builds and ships.

The role works closely with Engineering, DevOps, and the IT Governance, Risk & Compliance (GRC) function.

The role has a strong focus on AWS and cloud-native security across a modern microservices architecture.

Responsibilities

  • Define and maintain the information security strategy, standards, and roadmap, aligned to applicable regulations, rules, and security best practices.
  • Steer security architecture across a cloud-native environment, defining secure-by-design patterns for microservices, APIs, and shared platform services.
  • Establish and govern secure software development lifecycle (secure SDLC) practices, embedding automated security controls into CI/CD pipelines.
  • Define and drive adoption of cloud security guardrails - identity, network segmentation, encryption, secrets management, and configuration baselines.
  • Build and run security monitoring, logging, and threat detection across cloud, infrastructure, and application layers.
  • Lead the security incident response lifecycle - preparation, detection, containment, eradication, recovery, and post-incident review - and act as incident commander for security events.
  • Own vulnerability and threat management: scanning, risk-based prioritization, remediation tracking, and reporting across infrastructure, containers, and application code.
  • Plan and coordinate penetration testing and offensive-security exercises (in-house or co-sourced) and drive findings to closure.
  • Govern identity and access management, privileged access, and least-privilege principles across cloud and corporate systems.
  • Define and oversee data protection controls - encryption, key management, data classification, and loss prevention - for sensitive and cardholder data.
  • Secure corporate IT and office infrastructure, including endpoints, networks, and productivity and collaboration platforms.
  • Partner with Engineering and DevOps teams to make the secure path the easy path, providing tooling, standards, threat modelling, and design reviews.
  • Provide security input into architecture and change decisions, including the adoption of new technologies and third-party services.
  • Run security awareness and phishing-resilience programs for technical and non-technical staff.
  • Implement and evidence the technical security controls underpinning PCI DSS, ISO 27001, and SOC audits.
  • Monitor the evolving threat landscape and emerging security technologies.
  • Act as a key member of the internal security center of excellence and contribute to cross-functional security working groups.
  • Build, lead, and mentor a small security team.
  • Report security posture, key risks, and metrics.

Requirements

  • Bachelor’s or master’s degree in computer science, information security, or a related field, or equivalent practical experience.
  • At least 10 years in information / cyber security, including a minimum of 2-3 years in a leadership role, with hands-on experience securing cloud-native environments at scale.
  • Deep, practical public-cloud security knowledge (AWS strongly preferred): identity, networking, encryption, logging, and configuration management.
  • Strong experience securing DevOps / CI/CD pipelines and modern microservices architectures - containers, APIs, and infrastructure-as-code.
  • Working knowledge of application security and secure SDLC across modern programming languages and web frameworks.
  • Hands-on experience with security operations, incident response, and vulnerability management.
  • Solid understanding of security frameworks and compliance standards relevant to payments: ISO 27001, PCI DSS, SOC 2, and NIST CSF.
  • Working AI security literacy, with hands-on use of AI-assisted security tooling (e.g., GenAI coding assistants, AI-augmented SAST/DAST and SIEM/SOC analytics) and a practical understanding of securing AI/LLM and agentic applications, including AWS AI services such as Amazon Bedrock and the OWASP Top 10 risks for LLMs (e.g., prompt injection and data leakage).
  • Strong analytical and problem-solving ability, with high integrity and sound judgement.
  • Excellent verbal and written communication skills, fluent English, and the ability to influence engineers with data, logic, and best practices.

Considered as an Advantage

  • Professional certification such as CISSP, CCSP, OSCP, AWS Security Specialty, or CISM.
  • Experience in a payments, fintech, banking, or other regulated environment.
  • Familiarity with operational-resilience expectations (e.g. DORA-style requirements).
  • Experience standing up a security function.

Benefits

  • Fast-growing payment company;
  • Excellent working conditions, casual atmosphere, and state-of-the-art hardware;
  • Modern, challenging, constantly growing business;
  • Professional development - books, trainings, certifications, etc.;
  • Team buildings and fun activities;
  • 25 days paid holiday, 1 day for every 2 years with us;
  • Fully distributed and remote.

If you are interested, please apply with your CV in English only. Only short-listed candidates will be contacted.

Personal data of the applicants will be processed in strict confidentiality by emerchantpay ltd. UIC 175117520 solely for the purposes of selection and recruitment and will not be transferred to other data controllers unless required by law. Applicants provide their personal data on a voluntary basis and will have the right to access and correct their personal data within a reasonable time upon filing a written request.

emerchantpay is an equal opportunity employer. We appreciate people with different backgrounds and mindsets, and we honor diversity and inclusion.

Originally posted on Himalayas