Information Security & Risk Manager

About the role

We are seeking an experienced Regional Information Security Manager to lead cybersecurity governance and information security initiatives across multiple business entities in Eastern Europe. The role will develop and implement regional security strategies, manage cyber risk, and ensure compliance with global security standards.

Key responsibilities

• Implement and manage the regional information security strategy aligned with global security policies.
• Oversee cybersecurity governance across multiple countries and operational entities.
• Identify, assess, and mitigate cybersecurity risks through effective security controls and risk treatment plans.
• Coordinate security initiatives with corporate security and local IT teams.
• Ensure compliance with standards such as ISO 27001, NIST, PCI‑DSS and internal policies.
• Lead information security, business continuity, operational resilience, and physical security programs.
• Coordinate vulnerability assessments, penetration testing and remediation activities.
• Develop and maintain security roadmaps, policies, procedures and operational processes.
• Advise senior leadership on cybersecurity risks, compliance and strategic improvements.
• Manage security budgets, investments, reporting and continuous‑improvement initiatives.
• Support incident management, threat response and cyber‑resilience planning.
• Provide security awareness, guidance and training to business stakeholders and local teams.

Required profile

• Minimum 7 years of experience in information security, cybersecurity or IT security management.
• Strong expertise in cybersecurity governance, risk management and security operations.
• Proven leadership and stakeholder management across regional or multinational environments.
• Excellent written and verbal communication skills in English.
• Professional certifications such as CISSP, CISM or GIAC are highly desirable.
• Strong analytical, problem‑solving and decision‑making abilities.
• Willingness to travel occasionally within the assigned region.

Required skills

• Network security
• Firewalls
• VPNs
• Endpoint security
• Vulnerability management
• Penetration testing
• ISO 27001 framework
• NIST framework
• PCI‑DSS compliance
• CISSP, CISM or GIAC certifications (technical security knowledge)