Information Security Manager – GRC Engineering

About the role

We are looking for an Information Security Manager with a builder’s mindset to own and automate our compliance programmes (SOC 2, PCI DSS, HIPAA, DORA) on an AWS‑native stack. The role reports directly to the CISO and works in a hybrid setting from our Helsinki office.

Key responsibilities

• Build automated evidence pipelines for AWS, IAM and the security stack (Wiz, Vanta, SentinelOne, Datadog) and create self‑running control monitoring.
• Integrate compliance checks into CI/CD pipelines to catch drift before audits.
• Extend the Vanta compliance platform with custom integrations for uncovered controls.
• Own the full security & compliance programme (ISO 27001, SOC 2 Type 2, PCI DSS v4.0.1, HIPAA, DORA), including audit scoping, control testing and auditor relationships.
• Translate regulatory requirements into engineering‑ready specifications and tickets, and track them to closure.
• Manage vendor and third‑party risk under DORA and support incident response from a compliance perspective.

Required profile

• 3+ years of hands‑on security compliance experience, with ownership of at least one full SOC 2 or PCI DSS audit cycle.
• Proven ability to work closely with engineering and tech teams.
• Experience managing external auditors/QSAs through to a delivered report.
• Excellent written communication for engineers, auditors and executives.
• Comfortable operating in a small, ambiguous environment.

Required skills

• AWS and IAM
• Wiz, Vanta, SentinelOne, Datadog
• CI/CD integration
• ISO 27001, SOC 2, PCI DSS, HIPAA, DORA frameworks

What we offer

• Attractive remuneration and flexible remote work options.
• Choice of preferred OS (Windows or Mac).
• Flat hierarchy, transparent communication and a relaxed professional atmosphere.
• Company card with monthly allowance for meals and coffee.
• Equal‑opportunity employer with inclusive hiring process.