Chief Information Security Officer (CISO)

About the role

The Luxembourg Stock Exchange is seeking a senior leader to shape and embed a strong information security culture across the organisation. The Chief Information Security Officer will design, implement and continuously improve a comprehensive cybersecurity strategy, while ensuring robust user awareness and risk‑based controls.

Key responsibilities

• Raise user awareness and enhance the cyber‑risk culture within the organisation.
• Develop and deliver a training programme on information security for all employees.
• Define, implement and enforce information security strategies, policies and procedures.
• Maintain an inventory of information security risks in collaboration with business and risk teams.
• Assess and mitigate security risks in projects, change management and according to the organisation’s risk appetite.
• Document and design technical and functional controls to keep risk at acceptable levels.
• Oversee penetration‑testing activities, select providers and ensure remediation of findings.
• Monitor emerging cyber threats and provide timely awareness to stakeholders.
• Act as the primary contact for regulators and auditors on security matters.
• Develop and execute a control plan based on identified risks.
• Define and manage cyber‑incident management procedures and lead incident response.
• Define, implement and operate security monitoring in partnership with IT.
• Report security performance, risk indicators and critical issues to top management.
• Manage external consultants supporting the information security team.

Required profile

• University degree in IT, preferably with a specialization in cybersecurity.
• 5 to 10 years of relevant experience in a senior information security role.
• Basic understanding of financial markets.

Required skills

• Penetration testing coordination and remediation.
• Security monitoring strategy and operation.
• Risk assessment and risk‑based control design.
• Incident management and cyber‑incident response.
• Development and implementation of cybersecurity strategy and policies.