As a Cyber Security Manager, you will define, implement and enforce security standards across our modern, API-driven digital landscape. This role ensures the protection of our commercial platforms (esp. Salesforce, frontend, portal, integrations) while enabling speed and scalability in a fast-paced, resource-conscious environment where you'll need to balance multiple priorities.
Operating within a federated CISO model and the First Line of Defense, you will act as the primary security interface between the IQSIGHT business unit and the central CISO Office, and the central authority for cyber security across the IQSIGHT business unit's IT landscape, balancing risk mitigation with business agility and ensuring compliance with relevant regulatory frameworks (NIS2, GDPR, ISO 27001, and DORA where applicable).
Security Strategy & Governance
- Definition and implementation of a lean, risk-based cyber security strategy aligned with business priorities
- Adoption of security policies, standards, and controls across all digital platforms (CRM, frontend, APIs, ERP, MDM)
- Ownership of identity & access management strategy (SSO, RBAC, least privilege)
Architecture & Platform Security
- Close collaboration with the E2E IT Architect to embed security into architecture design (secure-by-design)
- Definition of security requirements for API-first and headless architecture (OAuth2, OIDC, token-based security)
- Ensuring secure integration patterns across Salesforce, portal, iPaaS, and backend systems
Risk, Compliance & Operational Security
- Execution of risk assessments, vulnerability management, and penetration testing coordination
- Define and oversee application security testing practices and code review processes. Ownership of monitoring, alerting, and incident response — acting as escalation point for security incidents and breaches
- Ensuring compliance with GDPR, NIS2, ISO 27001 for example and internal audit requirements; defining data protection and classification standards
Governance & Reporting
- Regular reporting to leadership on security risks, compliance status, and security KPIs/KRIs
- Participation in security governance boards and risk & compliance forums; escalation of critical risks to the central CISO Office
- Ensuring lessons learned from incidents are translated into improvements
Vendor & Stakeholder Management
- Security governance for external partners (Salesforce, implementation partners, SaaS vendors)
- Definition of security requirements in contracts, DPAs, and architecture decisions
- Acting as trusted security partner to business leadership — translating security policies into business-relevant requirements and aligning security priorities with business objectives and risk appetite
Product & AI Security
This role is not directly responsible for Product security but requires good stakeholder relationship management and collaboration with the Product team to drive efficacy.
- Collaborate with Product leads to define and maintain Product Security requirements and controls across all customer-facing applications, digital platforms, APIs, and SaaS solutions.
- Collaborate with Product leads to establish and govern secure coding standards, security architecture patterns, and application security requirements across development teams and external partners.
- Support DevSecOps adoption by integrating security controls, vulnerability management, and automated security testing into CI/CD pipelines.
- Support customer-facing security assessments, security questionnaires, audits, due diligence activities, and trust-center initiatives.
- Collaborate with CISO function to implement AI Security and AI Governance standards for AI-enabled products, services, and internal business solutions.
- Assess and manage security risks associated with Generative AI, Machine Learning, Large Language Models (LLMs), intelligent automation, and AI-powered business processes.
- Establish governance frameworks to ensure compliant, secure, and responsible adoption of AI technologies in alignment with business objectives and applicable regulations, including the EU AI Act where relevant.
- Implement security controls for AI applications, including model access management, identity controls, data protection, content filtering, human oversight, monitoring, and auditability.
- Review and approve the security architecture of AI solutions, AI-enabled products, third-party AI services, and AI integrations within the enterprise ecosystem.
- Collaborate with product, engineering, architecture, legal, compliance, and privacy teams to ensure AI systems meet security, privacy, ethical, and regulatory requirements.
- Monitor emerging AI threats, vulnerabilities, industry standards, and regulatory developments, translating them into pragmatic controls and security improvements.
- Provide leadership and guidance on secure AI adoption, promoting awareness and best practices across the organization.
- Education: Degree in Cyber Security, Information Security, Computer Science, or related field
- Experience: 7+ years in cyber security roles within modern cloud and SaaS environments; experience securing API-first architectures and enterprise SaaS platforms; experience working in cross-functional teams alongside architects, engineering, and business stakeholders
- Cloud & SaaS Security: Hands-on experience with cloud security (AWS/Azure) and enterprise SaaS platforms, with deep knowledge of Salesforce security models
- Integration & API Security: Strong understanding of OAuth2/OIDC, API gateway security, and securing integration layers (iPaaS, headless architecture)
- Frameworks & Regulation: Working knowledge of ISO 27001, NIST CSF, NIS2, and GDPR, plus familiarity with risk frameworks (e.g. ISO 27005, FAIR) — able to translate framework requirements into pragmatic controls
- Product & AI Security Experience: Experience securing customer-facing digital products and SaaS platforms, including application security, DevSecOps, software supply chain security, and AI-enabled solutions. Familiarity with AI security frameworks and emerging AI regulations such as the EU AI Act.
- Nice to have: Security certifications (e.g., CISSP, CISM, CISSP-ISSAP, AWS Certified Security – Specialty); experience contributing to large-scale technology transformation programmes (e.g., SAP/cloud migration, ERP rollouts, post-M&A integration)
- Personality and Working Style: Pragmatic, risk-based judgement; able to balance security rigor with business enablement; comfortable navigating ambiguity in a fast-moving environment
- Languages and Communication: Fluent English (written and spoken) required.
Keenfinity benefits includes:
⚖️ Flexible work conditions
🧑⚕️ Health insurance and medical office on site (nutrition, psychology, physiotherapy and general clinic)
🍽️ Canteen
🅿️ Free parking lot
🏋️ Sports and health related activities (gym)
📚 Training opportunities (i.e., technical training, foreign languages training) & certifications
📈 Opportunities for career progression and continuous professional development
🌐 Exchange with colleagues around the world
💲 Access to great discounts in partnerships and products
🌍All our positions are open to people with disability
-----
At Keenfinity we don’t just build innovative solutions — we shape a smarter, more connected world through technology.
We value different backgrounds, ideas, and experiences and we’re committed to growing, learning, and celebrating success as one team. Everyone is welcome here — we foster an environment where everyone is respected, valued, and encouraged to be their authentic self.
Keenfinity is an equal opportunity employer, offering equal opportunities for all. We welcome applications from people with disabilities and can offer support, if needed. When everyone has a chance to contribute, we all do better.