CISO + ICT Risk Manager + BCMO

Chief Information Security Officer (CISO) / Information Security Officer & ICT Risk Manager (m/f/d) & BCMO

About FLIZ

FLIZpay is a Berlin-based fintech making payments fee-free, instant and fair. Money moves straight from the bank account via SEPA, so shoppers save and businesses keep more of every sale. We are a small, fast-moving team in the early days of something big.

The role

As CISO/ISO you are responsible for our information security and cyber resilience. With DORA coming into force in 2025/2026, you are the architect of our "Digital Operational Resilience". You own the identification, assessment, management and monitoring of ICT risks across all business processes and ensure that our security and risk strategy is closely interlocked with the company's objectives. You establish security standards that do not slow us down but actually make our digital business model possible, pragmatic, automated and state-of-the-art.

Your responsibilities

• Taking on the independent function of Information Security Officer (ISO), reporting directly to management.
• Building, certifying (e.g. ISO 27001) and developing the information security management system (ISMS) and the ICT risk management framework in line with DORA (Art. 6).
• Implementing lean security-by-design and privacy-by-design principles in our software development lifecycle (CI/CD pipelines, DevSecOps).
• Developing and testing business continuity management (BCM) and IT disaster recovery plans.
• Building and managing ICT incident reporting to BaFin in accordance with DORA.
• Carrying out threat-intelligence analyses, vulnerability scans and penetration tests (TLPT).
• Performing the role of ICT risk manager under DORA, including building and continuously developing holistic ICT risk management.
• Identifying, assessing, managing and monitoring ICT risks, including defining risk tolerances and reporting to management.
• Establishing and maintaining a company-wide ICT risk register and running regular risk analyses and assessments.
• Managing ICT third-party risks (e.g. cloud providers), including risk analyses, contractual requirements and monitoring.

Who you are

• Degree in computer science, IT security or comparable technical expertise.
• Experience building ISMS and ICT risk management in regulated financial companies (ZAIT, BAIT, DORA).
• Understanding of modern cloud environments (AWS, GCP, Azure), containerisation (Kubernetes) and zero-trust architectures.
• Ability to translate IT and ICT risks for developers and management not as scaremongering but as calculable business risks.
• Sound knowledge of identifying, assessing and managing ICT risks and of regulatory requirements for risk management.
• Experience dealing with supervisory authorities and preparing risk reports at management and board level.
• Business-fluent English, German a big plus.
• Meaningful equity in an early-stage company
• Central Berlin office with flexible hybrid working
• Real ownership and direct impact on the product