[Hiring] InfoSec Manager @First Circle

Role Description

This is a unique opportunity for a high growth individual to become the first dedicated security professional at a high-growth, regulated bank whose market leadership position lies in its technology.

• Define strategy, priorities, and our security operating model aligned to business goals – reporting to the VP Engineering and supported in your development by our world-class CISO Board advisor.
• Build foundations, address primary risks, and ensure the bar you set is consistently upheld by the wider technology organisation.
• Own the ISO 27001 certification from scoping to audit pass.
• Implement external pen test & remediation; ensure every finding is closed or formally risk-accepted.
• Ensure MSSP/SOC is live and producing alerts we act on; measure SLAs monthly and drill the escalation path at least twice.
• Align engineering development processes with security; embed secure-by-design principles into technology and product development.
• Design, implement, and maintain security policies, standards, and procedures aligned to global standards and local regulations.
• Define, assess, and upgrade the law of least privilege across users & devices; ensure no unmanaged device touches production.
• Maintain a risk register used monthly by the exec team and Board, tied to mitigation owners and dates.
• Develop a strong culture & training practice, including phishing simulation and secure-coding standards.
• Evaluate and implement security tools and technologies, optimising for a lean, scalable security stack.

Qualifications

• Built a security function before, hands-on, at a regulated fintech, payments business, or bank.
• Led a Sev-1 incident from page to post-mortem.
• Taken an organisation through ISO 27001 as the responsible owner.
• Established an MSSP, chosen the vendor, defined use cases, and tuned alerts.
• Written IAM policy that survived contact with real engineers, preferably Azure-native.
• Hands-on enough to read Terraform, open a PR, and debug events.
• Certifications such as CISSP, CISM, CRISC, or ISO 27001 Lead Implementer/Auditor are useful signals.

Requirements

• Not a CISO inheriting a team; you'll build it, with one or two hires in Year 1.
• Not a paper-driven compliance role; expected to be in the codebase and on-call rotation when it matters.
• Not for someone who needs a clean SOC 2 starting point; the company is moving fast.
• No fixed budget for this role; offers adjusted based on experience and market rate.

Benefits

• Equity ownership in a 150%+ growing, profitable NeoBank.
• Flexibility around working hours and location; remote work options available.
• Macbooks, private health insurance, training budgets, and more!
• Periodic travel to HQ in Southeast Asia.