Mover Jobs

About The Position

Requirements

• 5+ years in security engineering or GRC, with time in a regulated environment.
• Track record of running security reviews on real initiatives and explaining security clearly to engineers, execs, and auditors.
• Experience designing and running security programs end-to-end – vulnerability management, access governance, or external testing (pentests, TLPT, ASV scans, bug bounty) – and driving findings to closure.
• Hands-on support for at least two of PCI DSS, DORA, CSSF, ISO 27001, or SOC 2, including direct work with external auditors.
• Working knowledge of AWS and Kubernetes – enough to read IaC, validate findings, and push back on weak fixes.
• Comfortable scripting and automating to cut manual GRC work.
• Strong written and spoken English.

Nice To Haves

• Experience building security automation or internal tooling that reduces manual effort – for vulnerability management, access reviews, or incident response.
• Experience in a fintech, payments, or EMI-licensed company

Responsibilities

• Review new products, features, architectural changes, vendors, and AI systems early in design – give a clear verdict on what's safe to ship, what must be fixed first, and what we accept.
• Own access recertification end-to-end (scope, automation, evidence, audit readiness) and make sure joiner/mover/leaver, privileged access, and SoD controls actually work across AWS, Kubernetes, SaaS, and internal tools.
• Run the remediation process end-to-end: severity model, SLAs, exceptions, ownership routing, escalation, and leadership reporting. Turn output from SAST, SCA, container, cloud, and AI scanners into prioritized work with readable dashboards.
• Design the IR and containment framework (escalation paths, isolation triggers, decision authority, documentation) and define logging standards – what's captured, retention, protection, reporting – so the security team and auditors can rely on it.
• Plan and run external testing across apps, AWS, Kubernetes, and AI systems: pentests, TLPT (DORA), ASV scans (PCI DSS), and bug bounty. Drive findings to closure and feed recurring issues back into preventive controls.
• Lead security workstreams across audits: scoping, evidence, walkthroughs, findings response, and remediation tracking.
• Maintain a living mapping of regulatory requirements to internal controls and evidence, and support Legal, Risk, and Compliance on ICT and third-party oversight – they own risk, you bring security context.

Benefits

• Hybrid model or fully remote
• Relocation support to Cyprus (visa, package)
• Competitive senior-level compensation
• Learning & development budget
• Fully paid vacation and sick leave
• Sports compensation