Information Security & Risk Manager

About the role

We are looking for a seasoned Regional Information Security & Risk Manager to lead cybersecurity governance and protect critical information assets across Eastern Europe. The role involves shaping security strategy, managing cyber risk, and ensuring compliance with global standards while collaborating with business leaders and IT teams.

Key responsibilities

• Implement and manage the regional information security strategy aligned with global policies.
• Oversee cybersecurity governance across multiple countries and operational entities.
• Identify, assess, and mitigate cybersecurity risks through effective controls and treatment plans.
• Coordinate security initiatives with corporate security and local IT teams.
• Ensure compliance with ISO 27001, NIST, PCI‑DSS, and internal policies.
• Lead business continuity, operational resilience, and physical security programs.
• Manage vulnerability assessments, penetration testing, and remediation activities.
• Develop and maintain security roadmaps, policies, procedures, and operational processes.
• Advise senior leadership on risks, compliance, and strategic improvements.
• Support incident management, threat response, and cyber‑resilience planning.
• Provide security awareness, guidance, and training to stakeholders.

Required profile

• Minimum 7 years of experience in information security, cybersecurity, or IT security management.
• Strong expertise in cybersecurity governance, risk management, and security operations.
• Proven leadership and stakeholder management in regional or multinational environments.
• Excellent written and verbal communication skills in English.
• Professional certifications such as CISSP, CISM, GIAC or equivalent are highly desirable.
• Willingness to travel occasionally within the region.

Required skills

• Network security
• Firewalls
• VPNs
• Endpoint security
• Vulnerability management
• Penetration testing
• ISO 27001
• NIST
• PCI‑DSS