SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Aspora is a borderless financial operating system founded in 2022, backed by Sequoia Capital, Greylock Partners, Y Combinator and others. The company operates across the EU, UK, UAE and India with 150+ employees, enabling cross-border money movement with regulatory compliance and transparency.
You will be the named local owner of ICT risk, information security and IT for Aspora's EU entity. This is a regulatory-facing role responsible for demonstrating security posture to regulators, auditors and partner banks on demand. You will report to the COO and work daily with Infrastructure, DevOps and the Head of Engineering.
Key responsibilities include:
— Build and run the DORA risk framework, policies, risk register and third-party register for the EU entity. Represent Aspora to the Bank of Lithuania, auditors and partner banks on all IT and security matters, and close audit findings before they age.
— Own and run the group ISO 27001 and PCI-DSS certification programme for the EU entity, ensuring one body of evidence serves every jurisdiction.
— Own the incident-response playbook including the regulatory notification path. Run disaster recovery and business continuity drills. Serve as technical counterpart to the Data Protection Officer on DPIAs, transfer assessments and breach notifications.
— Convert audit and regulatory requirements into engineering tickets with clear owners and dates, then follow each to closure.
— Manage entity IT operations: devices, identity and access, SaaS tooling, and joiner/mover/leaver processes for EU staff.
This role is positioned to grow into Aspora's senior security leadership seat. You will define what provable security looks like for a cross-border bank and set the standard every future entity inherits. You will have direct access to the COO and Head of Engineering, with authority to set the security bar and organizational support to hold it.
REQUIREMENTS:
— Proven experience working in regulated financial services (bank, EMI, payment institution or fintech)
— Hands-on experience running information security or ICT risk inside a financial institution
— Direct experience sitting across from regulators during inspections or incident notifications
— Demonstrated ability to close a full certification cycle: owned or materially ran ISO 27001, SOC 2 or PCI-DSS end to end (scoping through evidence to closing findings)
— Technical fluency: can read AWS access controls and vulnerability scans, triage what matters, and have credible technical conversations with engineering teams
— Hands-on incident response and disaster recovery experience, including making regulatory notification calls under pressure and staying accountable through post-incident remediation
— Fluent in Lithuanian and English, able to represent the entity to the Bank of Lithuania and partner banks in both languages, in writing and in person
— Desire to own the complete picture: framework, regulator relationship, certification and engineering follow-through for a cross-border bank still being built
