Inmation Security Internal Compliance Regulatory Specialist

Working At Bitso

We are a diverse team that takes pride in understanding the perspectives of others. We fully embrace working remotely and we are eager to act, improve and accelerate progress inside and outside of our organization.

To drive revolutionary changes in society and make crypto useful, we delight our customers with world-class products, deep care, and intentional empathy.

As our Information Security internal and Regulatory Compliance Specialist, you will be an integral part of the Information Security Governance, Risk, and Compliance team. Your role will involve defining, managing, enhancing, and maintaining the information security compliance program, as well as monitoring the effectiveness and maturity of Bitso's information security controls. Your role is essential to ensure company policies, technical standards and procedures are met, as well as support the definition of plans and mitigation activities for any identified gaps. Additionally, you will be responsible for coordinating and supporting external/internal audit and compliance exercises, including technical assessments.

As part of the information security governance, risk, and compliance team you will:

• Use holistic approaches interconnecting governance, risk, and compliance through project management and the application of industry best practices and standards
• Connect information security with other teams
• Ensure that the different lines of business are aligned with the defined security culture
• Use Agile approaches in your projects
• Focus on quality and excellence in your results

Beyond our team, you will collaborate closely with:

• Organizational risk, compliance, and regulatory internal and external teams to ensure proper adherence to information security compliance processes
• Technical groups to assist in implementing technical standards, controls, and configurations aligned with security policies, legal requirements, and audit standards

Reports To

Information Security Engineering Manager

Who You Are

• Proven English fluency.
• You are an information security professional with a minimum of 5 years of experience in information security roles
• You possess at least3 years of experience leading internal compliance assessments, leading internal audits, or acting as a strategic consultant with a focus on maturity assessments
• You have expert knowledge of information security frameworks and best practices (e.g., ISO 27k, COBIT, NIST 800, CSF, SANS CIS)
• You have proficiency in IT audit, compliance, and maturity assessments
• You are a Certified Information Systems Auditor (CISA) or possess an equivalent certification with a focus on IT audit
• You possess a competent understanding of the risk management process, with emphasis on risk treatment, monitoring, and control assessment phases
• You possess strong communication skills. These are crucial as the role involves coordinating with internal teams, external auditors, and various technical and non-technical groups. Being able to effectively communicate findings, recommendations, and remediation strategies to different levels of stakeholders is key
• You are detail-oriented. Given the role's responsibilities in monitoring compliance, identifying gaps, and managing security controls, attention to detail is vital. You should be meticulous in your work to ensure effective compliance and security measures are in place
• You are an agile and avid learner. Information security is a rapidly evolving field, so you have a willingness to continuously learn and stay updated on the latest trends, threats, and best practices in the industry. Keeping up-to-date will help in effectively implementing security measures
• Proven English proficiency. You are comfortable presenting to English speaking audiences and creating deliverables in that language. You are able to maintain a fluid conversation in English
• Finally, you are passionate about information security and you can see beyond the technology and controls. You find confluence points and create synergies. You believe in teamwork and you believe that by empowering an organization to protect itself you are on the side of a noble and much needed cause
• Optionally it is nice if you have:
• Minimum 2 years of strategic consulting experience, particularly within financial institutions.Additional certifications such as Certified ISO 27k Lead Auditor, CISSP, or PMP.Working knowledge with maturity models and frameworks (e.g. CMMI), cloud security best practices, project management (PMI), and Agile methodologies (e.g Kanban).Familiarity with Gibraltar Financial Services Commission regulations, General Data Protection Regulation (GDPR), and configuration management programs best practices.
• Minimum 2 years of strategic consulting experience, particularly within financial institutions.
• Additional certifications such as Certified ISO 27k Lead Auditor, CISSP, or PMP.
• Working knowledge with maturity models and frameworks (e.g. CMMI), cloud security best practices, project management (PMI), and Agile methodologies (e.g Kanban).
• Familiarity with Gibraltar Financial Services Commission regulations, General Data Protection Regulation (GDPR), and configuration management programs best practices.

What You Will Do

• Enhance and maintain the Information Security Compliance Program.
• Conduct regular information security and maturity assessments of Bitso's information security controls, and follow up on treatment plans across the organization.
• Continually validate the organization against the internal information security governance framework to ensure compliance, monitor for non-conformities, and prepare reports and metrics with recommended remediation strategies.
• Collaborate with internal and external security audits, proactive technical assessments, and tracking findings and recommendations for appropriate action will be crucial aspects of your responsibilities.
• Design technical testing protocols.
• Define, implement, and maintain a configuration program of enterprise assets
• Guide the security engineering team, liaise with various departments as necessary, and ensure the quality of information security programs and projects.