Head of InfoSec & ICT Risk - LemFi Europe

LemFi
Dublin, Ireland
Hybrid

Who this role is best for

A natural match if you have experience in ICT risk governance within a Central Bank of Ireland-regulated firm, particularly in fintech or payments.

Best fit for

  • Candidates with experience in ICT risk governance at Central Bank of Ireland-regulated firms, especially in fintech or payments.
    — “You've owned information security or ICT risk governance at a Central Bank of Ireland regulated firm, ideally in payments, e-money or fintech”
  • Professionals who prefer automation over manual processes and have a track record in GRC tool integration.
    — “You're a builder at a scaling company, not a maintainer in an enterprise. You'd rather automate a control than add a process step.”
  • Individuals with a strong background in regulatory compliance and a proven ability to communicate clearly with boards and regulators.
    — “You write for boards and regulators the way they want to read: short, specific and decision-led.”

Things to consider

  • This role requires direct engagement with the Central Bank of Ireland and a high level of regulatory accountability.
    — “Be the Central Bank of Ireland's point of contact on information security, ICT risk and operational resilience”
  • The position involves a hybrid work arrangement with one day per week in the Dublin office.
    — “Based in Dublin, one day a week in our Dublin office”

How to stand out

  • Highlight your hands-on experience in implementing DORA frameworks and managing ICT third-party risks.
    — “Own our DORA ICT risk management framework end to end: policies, risk appetite, control library and the annual review that goes to the board.”
  • Demonstrate your ability to use AI tools in GRC work to show alignment with the company's tech-forward approach.
    — “You use AI tools daily and you're always looking for ways to apply them to GRC work.”
  • Showcase your experience with GRC automation platforms like Vanta or Drata and cloud integration.
    — “Experience with GRC automation platforms such as Vanta or Drata, and integrating them with cloud, identity and ticketing tools.”
  • Emphasize your track record in translating regulatory requirements into testable controls.
    — “Partner with our security engineers, who own the hands-on build, translating regulatory requirements into clear, testable controls.”
  • Position yourself as a proactive problem-solver who takes ownership of regulatory findings.
    — “You take ownership. A Central Bank finding is yours to close, not someone else's problem.”
Pace · SteadyCollaboration · HighAutonomy · HighDecision Impact · Company

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

  • DORA ICT risk management framework
  • Central Bank of Ireland compliance
  • digital operational resilience testing
Typical background
information securityregulatory compliance

Skills & requirements

Required

Information SecurityICT Risk ManagementRegulatory ComplianceOperational Resilience

Preferred

DORACloud SecurityAutomation

Stack & domain

DORAInformation SecurityICT Risk ManagementCloudIdentitySoftware DeliveryFinancial ServicesRegulatory Compliance

About the role

Original posting from LemFi via Ashby

Ambition has no passport. That belief is why LemFi https://lemfi.com/en-gb/careers exists. We're the financial engine for people the world wasn't built to serve, the millions who move countries to build something better and find the financial system hasn't caught up with them yet. We started with remittances: the money people send home to the people they love. Now we run multi-currency accounts, Savings, eSIMs and Credit. Because staying connected to home and building somewhere new are not two separate things. They never were.

THE ROLE

Our Irish entity is regulated by the Central Bank of Ireland, and that brings DORA with it. We're hiring our Head of InfoSec & ICT Risk Europe to own it: the ICT risk control function, our information security management system, and the relationship with the Central Bank on everything security and resilience.

This is a governance and control seat, not an engineering one. Our security engineers build and break things. You set the framework they build against, prove it works, and have the evidence ready before anyone asks for it.

You'll do it with automation, not spreadsheets. If a control can be monitored by a tool, it should be, and you'll be the one wiring those tools into our stack. Based in Dublin, one day a week in our Dublin office, reporting to our CTO.

HOW YOU'LL CONTRIBUTE

  • Own our DORA ICT risk management framework end to end: policies, risk appetite, control library and the annual review that goes to the board.
  • Act as our independent ICT risk control function, giving engineering and the business real second line challenge rather than sign-off.
  • Be the Central Bank of Ireland's point of contact on information security, ICT risk and operational resilience, from information requests and inspections to remediation plans.
  • Run major ICT incident classification and reporting within DORA timelines, working with engineering on root cause and making sure fixes land.
  • Own ICT third-party risk: the register of information, due diligence and contract terms for critical providers, and exit plans that would actually work.
  • Run our digital operational resilience testing programme, from scoping vulnerability assessments and scenario tests to tracking findings to closure.
  • Automate compliance. Integrate GRC tooling with our cloud, identity, HR and ticketing systems so controls are monitored continuously, not evidenced once a year.
  • Own information security policy, awareness training and the ISMS, aligned to ISO 27001.
  • Turn our security and resilience posture into reporting the board, leadership team and regulator can act on: key risk indicators, the risk register and the decisions needed.
  • Partner with our security engineers, who own the hands-on build, translating regulatory requirements into clear, testable controls.

WHO YOU ARE

  • You've owned information security or ICT risk governance at a Central Bank of Ireland regulated firm, ideally in payments, e-money or fintech, and dealt with the Central Bank directly.
  • You know DORA from doing it, not from a training course. You've built the register, classified real incidents or stood up the framework yourself.
  • You're a builder at a scaling company, not a maintainer in an enterprise. You'd rather automate a control than add a process step.
  • You're technically credible. You understand cloud, identity and software delivery well enough to challenge engineers and spot evidence that doesn't stack up, without needing to be hands-on.
  • You write for boards and regulators the way they want to read: short, specific and decision-led.
  • You take ownership. A Central Bank finding is yours to close, not someone else's problem.
  • You have grit. You keep moving when the regulation is ambiguous and the deadline isn't.
  • You use AI tools daily and you're always looking for ways to apply them to GRC work.

WHAT YOU'LL BRING

  • 7+ years in information security, ICT risk or technology risk, with at least 3 in a regulated financial services firm.
  • Working knowledge of DORA and its technical standards, plus Central Bank of Ireland expectations on operational resilience and outsourcing.
  • Experience building or running an ISMS aligned to ISO 27001.
  • Experience with GRC automation platforms such as Vanta or Drata, and integrating them with cloud, identity and ticketing tools.
  • A track record managing ICT third-party risk and incident reporting in a regulated environment.
  • Nice to have: NIS2, PCI DSS or GDPR experience, AWS familiarity, and a CISM, CISSP, CRISC or ISO 27001 Lead Implementer or Auditor certification.

WHY JOIN LEMFI?

Your work here puts money back into families' pockets. That's the reward, and the weight of it. You'll take on some of the hardest problems in finance alongside people who do their best work when the stakes are real. We move fast and we expect a lot, because our customers can't afford for us to do otherwise. In return you get room to own real problems, global impact you can see, and a team that won't slow you down.

Bring grit and ownership and there's a place for them here. Ambition belongs here, come and show us yours.

Follow us on LinkedIn https://www.linkedin.com/company/lemfi/ and Instagram https://www.instagram.com/uselemfi/ and if you haven't already, download the app on the App Store https://apps.apple.com/gb/app/lemfi/id1533066809 or Google Play https://play.google.com/store/apps/details?hl=en&id=com.lemonadeFinance.android.

Don't feel that you're right for this role, but want to submit your interest in working for LemFi? You can join our talent community https://jobs.ashbyhq.com/lemfi/form/talent-community to stay in touch for future opportunities.

RECRUITMENT AGENCIES NOTICE

LemFi does not accept unsolicited CVs from recruitment agencies. We work only with agencies on our preferred supplier list, and only when we’ve asked them for their support. Any CVs sent to us outside this arrangement will not incur a fee.

AI IN HIRING AT LEMFI

We use AI to cut admin, like notetakers that let interviewers focus on the conversation instead of typing. AI never makes hiring decisions. That responsibility always sits with our hiring teams. Read our AI use policy https://www.lemfi.com/en-gb/legal/candidate-ai-use to see how we use AI and how we expect you to use it too.

Source: LemFi careers (Ashby)

Similar roles

More roles at LemFi