Information Security Lead
- Compensation
- Not disclosed
- Location
- Sofia, Sofia City Province, Bulgaria
- Work setup
- Remote
- Seniority
- Lead
- Employment
- Not specified
- Experience
- 2+ years
- Category
- Security
- Posted
Skills
Must have
- Bachelor’s or master’s degree in computer science, information security, or a related field, or equivalent practical experience.
- At least 10 years in information / cyber security, including a minimum of 2-3 years in a leadership role, with hands-on experience securing cloud-native environments at scale.
- Deep, practical public-cloud security knowledge (AWS strongly preferred): identity, networking, encryption, logging, and configuration management.
- Strong experience securing DevOps / CI/CD pipelines and modern microservices architectures - containers, APIs, and infrastructure-as-code.
- Working knowledge of application security and secure SDLC across modern programming languages and web frameworks.
- Hands-on experience with security operations, incident response, and vulnerability management.
- Solid understanding of security frameworks and compliance standards relevant to payments: ISO 27001, PCI DSS, SOC 2, and NIST CSF.
- Working AI security literacy, with hands-on use of AI-assisted security tooling (e.g., GenAI coding assistants, AI-augmented SAST/DAST and SIEM/SOC analytics) and a practical understanding of securing
- Strong analytical and problem-solving ability, with high integrity and sound judgement.
- Excellent verbal and written communication skills, fluent English, and the ability to influence engineers with data, logic, and best practices.
Full description
emerchantpay is a leading global payment service provider and acquirer for online, mobile, in-store and over the phone payments. Our global payments solution is available through a simple integration, offering a diverse range of features, including global acquiring, global and local payment methods, advanced fraud management and performance optimisation. We empower businesses to design seamless and engaging payment experiences for their consumers.
We are looking for an experienced Information Security Lead to own the design, implementation, and continuous improvement of information security across our cloud-native, DevOps-driven engineering environment, as well as our corporate IT and office infrastructure.The role combines hands-on technical delivery with security leadership. The Information Security Lead will set security direction and personally drive its execution - securing our cloud platform, delivery pipelines, and microservices, leading security operations and incident response, and embedding security into how engineering builds and ships.
The role works closely with Engineering, DevOps, and the IT Governance, Risk & Compliance (GRC) function.
The role has a strong focus on AWS and cloud-native security across a modern microservices architecture.
Responsibilities
- Define and maintain the information security strategy, standards, and roadmap, aligned to applicable regulations, rules, and security best practices.
- Steer security architecture across a cloud-native environment, defining secure-by-design patterns for microservices, APIs, and shared platform services.
- Establish and govern secure software development lifecycle (secure SDLC) practices, embedding automated security controls into CI/CD pipelines.
- Define and drive adoption of cloud security guardrails - identity, network segmentation, encryption, secrets management, and configuration baselines.
- Build and run security monitoring, logging, and threat detection across cloud, infrastructure, and application layers.
- Lead the security incident response lifecycle - preparation, detection, containment, eradication, recovery, and post-incident review - and act as incident commander for security events.
- Own vulnerability and threat management: scanning, risk-based prioritization, remediation tracking, and reporting across infrastructure, containers, and application code.
- Plan and coordinate penetration testing and offensive-security exercises (in-house or co-sourced) and drive findings to closure.
- Govern identity and access management, privileged access, and least-privilege principles across cloud and corporate systems.
- Define and oversee data protection controls - encryption, key management, data classification, and loss prevention - for sensitive and cardholder data.