[Hiring] IT Manager @Shopify

Role Description

Shopify is building a licensed Electronic Money Institution (EMI) in Luxembourg, supervised by the Commission de Surveillance du Secteur Financier (CSSF). As an IT Manager on our Trust team, you'll make sure the entity meets the requirements of the Digital Operational Resilience Act (DORA) and CSSF expectations for the management of ICT risk, and marry that with how Shopify manages these risks globally.

Your job is to take that program and make it work for the Luxembourg entity:

• Run the DORA and ICT risk program for the Luxembourg entity, adapting Shopify's global security program to local requirements.
• Maintain the ICT risk register, policies, and leadership reporting current.
• Manage incident classification and reporting so major ICT incidents reach the CSSF on time.
• Oversee business continuity, disaster recovery, and resilience testing, including Threat-Led Penetration Testing (TLPT) where required.
• Maintain the ICT third-party register, monitor critical providers against their service levels, and work with legal so contracts meet DORA requirements.
• Document where entity data is stored and processed to meet regulatory requirements.
• Run security controls and prepare evidence for audits and regulatory reviews, using automation and AI to cut manual work.
• Help regulators understand how Shopify builds, operates, and uses AI.
• Stay on top of changes to DORA and CSSF rules, and run annual security awareness training for the entity.

Qualifications

• Experience in information security, IT risk, or technology compliance in a regulated financial services environment, such as a bank, payment institution, EMI, or insurer.
• Hands-on knowledge of DORA, or of the areas it brings together: ICT outsourcing and third-party risk, IT business continuity and resilience, ICT incident management, and information security.
• Working knowledge of at least one recognized security framework, such as ISO 27001, NIST CSF, or COBIT.
• Experience running controls, collecting audit evidence, and working with auditors or regulators.
• A practical approach to risk: you know how to meet a regulatory requirement in a way that fits a fast-moving tech company.
• Comfort using AI tools to gather context and speed up your work, along with the judgment to check what they produce.
• Clear written and verbal communication, including explaining technical risk to non-technical stakeholders and regulators.
• Professional fluency in English.

Requirements

• Experience with both technology companies and financial services.
• Familiarity with CSSF ICT circulars, such as CSSF 22/806 and 25/880.
• Experience at a Luxembourg-regulated entity, or direct experience with CSSF supervisory processes.
• Experience with cloud infrastructure (GCP, AWS, or Azure) and infrastructure as code in a regulated setting.
• Certifications such as CISM, CISSP, CISA, or ISO 27001 Lead Implementer/Auditor.
• Familiarity with Luxembourg data protection requirements for financial entities.

Benefits

You'll be the person accountable for ICT risk for a newly licensed financial institution inside a global technology company. You'll see how a regulated entity runs from the start, work with a security team that treats automation and AI as everyday tools, and influence what modern, cloud-native compliance can look like.