Chief Information Security Officer

About the role

As the Chief Information Security Officer at INFINIT, you will be the single point of contact for the Board and the CSSF on all ICT, security and operational resilience matters for our Luxembourg‑licensed Payment Institution. You will design and build a proportionate IT and security governance framework that meets evolving regulations such as DORA, CSSF Circular 25/880 and the upcoming PSD3.

Key responsibilities

• Design, implement and maintain an ICT risk management framework aligned with DORA and CSSF requirements.
• Draft, update and enforce information security policies and procedures.
• Maintain the ICT third‑party register, covering cloud providers, software vendors and critical subcontractors.
• Prepare and deliver regular ICT reports to the Board and the CSSF, including incidents, KRIs and resilience test outcomes.
• Lead digital operational resilience testing programmes, including TLPT where applicable.
• Anticipate and manage regulatory implications of the Group’s European expansion, engaging with local regulators in passported jurisdictions.
• Represent the entity during on‑site and remote supervisory reviews conducted by the CSSF.

Required profile

• 6‑7+ years of experience in information security, preferably within a fintech or payment‑institution environment.
• Demonstrated expertise with EU regulatory frameworks such as DORA, CSSF Circular 25/880 and PSD3.
• Proven ability to interact with senior management and regulators.
• Strong background in governance, risk management and operational resilience.

Required skills

• ICT risk management and governance.
• Information security policy development.
• Regulatory compliance (DORA, CSSF Circular 25/880, PSD3).
• Third‑party risk management.
• Incident reporting and digital operational resilience testing (TLPT).