Chief Information Security Officer

About the role

INFINIT is a fast‑growing fintech scale‑up that provides an AI‑driven operating system for SMEs. As Chief Information Security Officer, you will be the single point of contact for the Board and the Luxembourg regulator (CSSF) on all ICT, security and operational resilience matters for its CSSF‑licensed Payment Institution.

Key responsibilities

• Design and implement a proportionate ICT risk‑management and security governance framework in line with DORA, CSSF Circular 25/880 and upcoming PSD3.
• Maintain and update information‑security policies, procedures and the ICT third‑party register (cloud providers, software vendors, critical sub‑contractors).
• Prepare and deliver regular ICT reporting to the Board and the CSSF, including incidents, KRIs and resilience‑test outcomes.
• Lead digital operational resilience testing programmes, including TLPT where applicable.
• Support the Group’s European expansion by engaging with local regulators and ensuring compliance with jurisdiction‑specific ICT and security requirements.
• Represent the entity during on‑site and remote supervisory reviews conducted by the CSSF.

Required profile

• 6‑7+ years of experience in information security, ICT risk management or related regulatory roles within the financial sector.
• Proven ability to work with senior management and regulators, and to build governance frameworks from the ground up.
• Strong understanding of European regulatory environments such as DORA, CSSF Circular 25/880 and PSD3.
• Excellent communication skills in English; French is a plus.

Required skills

• ICT risk‑management
• Information‑security policy development
• Third‑party risk management
• Digital operational resilience testing (including TLPT)
• Regulatory compliance (DORA, CSSF Circular 25/880, PSD3)