Product Cyber Security Officer

Northmill Bank is a challenger bank at the intersection of technology and finance, committed to revolutionizing the way people manage and protect their financial well-being. We are creating a different kind of banking experience, digital yet personal. Northmill Bank was founded in 2006 and have grown to over 240 employees in 3 countries, 4 000 merchants and 600 000 end users. We use the latest technology to develop safe, smart, and user-friendly products for our customers. They are the sole reason why we do what we do. We are a 100% cloud-based product company where technology is the driver to create smarter banking products. Grab this opportunity to be a part of us and our journey! About the role The Information Security Officer is subject matter expert, and a member of the Information Security team in the second line of defense. The team is tasked to provide governance, oversight and guidance, meaning to ICT write policies, and monitor and control first line’s compliance towards these policies. The team also has a number of security capabilities that we provide ourselves, such as technical security scanners or security training activities. While the team’s primary responsibility is governance, oversight, this is a small bank and you will also play a hands-on role in driving security initiatives, designing procedures, and building security capabilities. You will directly influence the secure design of systems, support risk management, and respond to security incidents. Much of information security material needs a significant rewrite, so this role comes with a great opportunity to use prior experience to influence the Bank’s ways of working, risk appetite and ultimately its risk posture. You will have a blank canvas to modernize our security framework, moving us from legacy documentation to a lean, ISO 27001-aligned 'Version 2.0.' This is a rare opportunity to use your experience to directly shape the Bank’s ways of working, risk appetite, and long-term security posture. What you will do Translating information security requirements into practical, effective, and business-aligned policies, procedures, guidelines or strategies. Northmill is both a bank and payment provider in multiple European regions, and also has a number of business requirements affecting information security. Monitor compliance for our internal information security rules and our applicable business and regulatory requirements. DORA, GDPR, PSD2, FFFS, Visa, Swift, Swish, Bankgirot, Rixbanken, etc. Structure information security requirements in the ISMS in alignment with the ISO 27001 standard. Act as an advisor and lead for information, cyber security, or privacy incidents. Serve as a subject matter expert within privacy and data protection Act as subject matter expert in relation to our PCI-DSS certification and conduct readiness assessments towards the business. Keep track of that recurring tasks are performed as needed. Contribute to reporting towards supervisory authorities (e.g. SFSA, IMY, FIN-FSA) Ensure that the organization has relevant security awareness and training in place Lead and participate in Business Impact Analysis, ICT vendor approval, the Register of Information, Critical and Important functions, ICT Risk assessments, Data Protection Impact Assessments, IA-act risk assessments, NPAP, and various GAP analyses. What we are looking for Experience working as an Information Security Officer or in a similar role Hands-on experience in developing policies, procedures, and security frameworks A pragmatic mindset and a strong understanding of how to balance regulatory requirements with business needs Strong problem-solving skills and the ability to operate in a dynamic environment A collaborative approach and willingness to work closely with different parts of the organization Professional proficiency in both Swedish and English (Finnish or German is a plus) Based in Stockholm, with EU/EEA residency or citizenship Certifications such as CISM or ISO 27001 Lead Implementer are meritorious, but not required. What we offer A fantastic office in a prime Stockholm location with great spaces and views An independent role with the opportunity to make a real impact Great opportunities for professional development Health - 5 000 kr health care allowance Conference abroad every other year Breakfast and fruits every day, as well as "holy fika” each Friday Regular after work and celebrated successes at the office Apply today and be a part of Northmill!

Who is PawaPay PawaPay is a pan-African fintech enabling local payment channels used by the mass market to both local and international merchants. We operate in a highly regulated, partner-driven environment and are in scale-up mode, with ambitious growth plans across multiple African markets. Our vision is to simplify business for companies and consumers in Africa and we do that by ensuring that payments simply work, at scale, despite fragmentation and complexity that exists on the Continent. Through our payments API we already facilitate over 4 million transactions a day across 20 countries in Sub-Saharan Africa.  We are the largest PSP on the Continent for the processing of mobile money payments, and have positioned ourselves well to lead the payment space as it grows over the next decade. At PawaPay, there is an entrepreneurial spirit coupled with a modern and professional working culture. The fast-paced, ever-changing environment will suit someone who can adapt and think on their feet. In return, you will have the opportunity to work alongside a group of dedicated and smart individuals working towards the same mission. We work as a remote team and have team members in Europe, Africa and Asia. The Role As Cybersecurity Officer for West Africa, you will be responsible for executing PawaPay's cybersecurity programme across the region. Reporting to the Head of Cybersecurity, you will serve as PawaPay's primary cybersecurity representative across Francophone and Anglophone West Africa. You will implement the company's global cybersecurity strategy while ensuring security controls, regulatory requirements and operational practices are effectively applied within the regional context. This is a hands-on operational role requiring someone who is equally comfortable discussing technical security issues with Engineering teams as they are supporting regulators, auditors and business stakeholders. You will own day-to-day regional cybersecurity activities, coordinate security operations, drive remediation of security risks and audit findings, and ensure cybersecurity remains embedded within the way pawaPay operates across West Africa. Salary: USD 30,000–45,000 per annum, depending on experience, skills and location. Key Responsibilities * Execute PawaPay's cybersecurity programme across West African operations in line with the company's global cybersecurity strategy and standards. * Conduct security risk assessments, vulnerability reviews and security control assessments, ensuring risks are prioritised and practical remediation plans are implemented. * Coordinate regional security incident response activities, working closely with Engineering and Operations teams to investigate, contain and remediate security issues. * Drive timely remediation of vulnerabilities, penetration test findings, audit actions and security risks by working cross-functionally with Engineering, Product, Operations and Compliance teams. * Support regulatory engagements, security audits and compliance reviews with central banks, regulators, cybersecurity authorities and data protection authorities across Francophone and Anglophone West Africa. * Ensure regional adoption of pawaPay's security policies, standards and control frameworks while adapting implementation to local regulatory requirements where appropriate. * Act as the primary cybersecurity point of contact across West Africa, providing practical guidance to internal stakeholders and building trusted relationships across technical and non-technical teams. * Coordinate third-party security assessments, penetration tests and security reviews, ensuring findings are tracked through to completion. * Deliver regional security awareness initiatives and promote a strong security culture across the business. * Monitor the evolving cybersecurity and regulatory landscape across West Africa, identifying emerging risks and recommending appropriate improvements. You Are a Great Fit If You Have * 4+ years' experience in cybersecurity, information security or IT security within fintech, telecommunications, banking or another regulated industry. * Professional fluency in both English and French (written and spoken). This is essential for supporting our Francophone West Africa operations. * Practical experience implementing and applying recognised security frameworks such as ISO 27001, NIST, PCI-DSS or similar within regulated environments. * Hands-on experience with vulnerability management, security incident response, security monitoring and risk management. * Experience supporting security audits, regulatory reviews or compliance assessments. * Familiarity with mobile money ecosystems, payment infrastructure, API-driven platforms or financial services technology. * Experience working with security technologies such as SIEM, EDR, vulnerability management platforms or similar security tooling. * Strong stakeholder management skills, with the ability to influence Engineering, Product and Operations teams and drive security improvements without direct authority. * Excellent communication skills with the ability to translate technical risks into clear, business-focused recommendations. * A Bachelor's degree in Cybersecurity, Computer Science, Information Technology or a related discipline. * Relevant certifications such as CISSP, CISA, CEH, ISO 27001 Lead Auditor/Implementer or equivalent are advantageous. Success in this Role Within your first year you will: * Become the trusted cybersecurity point of contact across West Africa. * Successfully support regulatory, audit and compliance engagements with minimal escalation. * Drive timely closure of security vulnerabilities, penetration test findings and audit actions across the region. * Build strong working relationships with Engineering, Operations, Product, Compliance and Regulatory teams. * Strengthen pawaPay's cybersecurity posture by ensuring regional risks are proactively identified, prioritised and remediated. Why PawaPay? * Help improve financial access in Africa * Being part of an amazing team that shapes company’s culture as a great place to be * An ambitious, talented, and diverse team who always has your back * We grow fast, and you will grow fast with us * Competitive remuneration * 35 days of paid leave per year (inclusive of public holidays) and more.