Head of InfoSec & ICT Risk - LemFi Europe

Ambition has no passport. That belief is why LemFi exists. We're the financial engine for people the world wasn't built to serve, the millions who move countries to build something better and find the financial system hasn't caught up with them yet. We started with remittances: the money people send home to the people they love. Now we run multi-currency accounts, Savings, eSIMs and Credit. Because staying connected to home and building somewhere new are not two separate things. They never were.

Our Irish entity is regulated by the Central Bank of Ireland, and that brings DORA with it. We're hiring our Head of InfoSec & ICT Risk Europe to own it: the ICT risk control function, our information security management system, and the relationship with the Central Bank on everything security and resilience.

This is a governance and control seat, not an engineering one. Our security engineers build and break things. You set the framework they build against, prove it works, and have the evidence ready before anyone asks for it.

You'll do it with automation, not spreadsheets. If a control can be monitored by a tool, it should be, and you'll be the one wiring those tools into our stack. Based in Dublin, one day a week in our Dublin office, reporting to our CTO.

• Own our DORA ICT risk management framework end to end: policies, risk appetite, control library and the annual review that goes to the board.

• Act as our independent ICT risk control function, giving engineering and the business real second line challenge rather than sign-off.

• Be the Central Bank of Ireland's point of contact on information security, ICT risk and operational resilience, from information requests and inspections to remediation plans.

• Run major ICT incident classification and reporting within DORA timelines, working with engineering on root cause and making sure fixes land.

• Own ICT third-party risk: the register of information, due diligence and contract terms for critical providers, and exit plans that would actually work.

• Run our digital operational resilience testing programme, from scoping vulnerability assessments and scenario tests to tracking findings to closure.

• Automate compliance. Integrate GRC tooling with our cloud, identity, HR and ticketing systems so controls are monitored continuously, not evidenced once a year.

• Own information security policy, awareness training and the ISMS, aligned to ISO 27001.

• Turn our security and resilience posture into reporting the board, leadership team and regulator can act on: key risk indicators, the risk register and the decisions needed.

• Partner with our security engineers, who own the hands-on build, translating regulatory requirements into clear, testable controls.

• You've owned information security or ICT risk governance at a Central Bank of Ireland regulated firm, ideally in payments, e-money or fintech, and dealt with the Central Bank directly.

• You know DORA from doing it, not from a training course. You've built the register, classified real incidents or stood up the framework yourself.

• You're a builder at a scaling company, not a maintainer in an enterprise. You'd rather automate a control than add a process step.

• You're technically credible. You understand cloud, identity and software delivery well enough to challenge engineers and spot evidence that doesn't stack up, without needing to be hands-on.

• You write for boards and regulators the way they want to read: short, specific and decision-led.

• You take ownership. A Central Bank finding is yours to close, not someone else's problem.

• You have grit. You keep moving when the regulation is ambiguous and the deadline isn't.

• You use AI tools daily and you're always looking for ways to apply them to GRC work.

• 7+ years in information security, ICT risk or technology risk, with at least 3 in a regulated financial services firm.

• Working knowledge of DORA and its technical standards, plus Central Bank of Ireland expectations on operational resilience and outsourcing.

• Experience building or running an ISMS aligned to ISO 27001.

• Experience with GRC automation platforms such as Vanta or Drata, and integrating them with cloud, identity and ticketing tools.

• A track record managing ICT third-party risk and incident reporting in a regulated environment.

• Nice to have: NIS2, PCI DSS or GDPR experience, AWS familiarity, and a CISM, CISSP, CRISC or ISO 27001 Lead Implementer or Auditor certification.

Your work here puts money back into families' pockets. That's the reward, and the weight of it. You'll take on some of the hardest problems in finance alongside people who do their best work when the stakes are real. We move fast and we expect a lot, because our customers can't afford for us to do otherwise. In return you get room to own real problems, global impact you can see, and a team that won't slow you down.

Bring grit and ownership and there's a place for them here. Ambition belongs here, come and show us yours.
Follow us on LinkedIn and Instagram and if you haven't already, download the app on the App Store or Google Play.

Don't feel that you're right for this role, but want to submit your interest in working for LemFi? You can join our talent community to stay in touch for future opportunities.

LemFi does not accept unsolicited CVs from recruitment agencies. We work only with agencies on our preferred supplier list, and only when we’ve asked them for their support. Any CVs sent to us outside this arrangement will not incur a fee.

We use AI to cut admin, like notetakers that let interviewers focus on the conversation instead of typing. AI never makes hiring decisions. That responsibility always sits with our hiring teams. Read our AI use policy to see how we use AI and how we expect you to use it too.