Senior Security GRC Lead

About the role

We are looking for an experienced Senior Security GRC Lead to join our fintech team in Luxembourg. The role is split 50/50 between supporting the EMEA regional security strategy and ensuring local compliance with CSSF and DORA regulations.

Key responsibilities

• Develop and maintain the information security strategy and governance framework.
• Lead compliance initiatives for DORA, CSSF Circular 25/880, PSD2‑SCA, PCI‑DSS, SWIFT CSP, ISO‑27001 and EBA guidelines.
• Identify, assess and prioritize ICT security risks, produce the annual Long Form Report and manage third‑party vendor risk.
• Design and execute DORA‑compliant digital operational resilience testing, including threat‑led penetration testing.
• Oversee incident response capabilities and continuous security monitoring.
• Provide security awareness training and foster a security‑first culture.
• Act as the primary liaison for audit and regulatory engagements.

Required profile

• Extensive experience in information security governance, risk and compliance within the financial sector.
• Strong knowledge of Luxembourg financial regulations (CSSF) and EU DORA requirements.
• Proven ability to lead cross‑functional security initiatives and interact with senior management.

Required skills

• SIEM
• DLP
• Endpoint Security