Cyber & Information Security Officer

About Two

Two is a decisioning platform powering B2B commerce, facilitating credit decision making, identity verification, and fraud prevention for businesses. The platform manages over €1 billion annually across Norway, Sweden, and the UK, and is progressing towards becoming a licensed credit institution in Sweden.

Role Overview

As an Information Security Officer, you will lead and enhance the cyber security and data protection initiatives within the organization. You will be responsible for establishing governance around information security and personal data compliance, ensuring adherence to standards across the company, and providing assurance to regulators, customers, and auditors.

Key Responsibilities

• Manage and continuously improve the Information Security Management System (ISMS) and security policy framework in alignment with ISO 27001 and DORA regulations.
• Conduct comprehensive cyber and information risk assessments and prepare reports for the board.
• Oversee risks related to third-party vendors and ICT suppliers including tiering, due diligence processes, Data Processing Agreements, and ongoing evaluation.
• Lead compliance efforts for EEA-EU GDPR and UK GDPR including maintaining processing records, conducting Data Protection Impact Assessments (DPIAs), updating privacy notices, managing data subject requests, and regulating international data transfers.
• Assess incidents involving personal data breaches and act as the primary contact for data protection authorities.
• Contribute to the ICT and security requirements for Two’s Swedish credit institution licensing process.
• Confidently respond to client security and privacy queries and due diligence requests.
• Execute and enhance the security and privacy training program to increase staff awareness.

Candidate Qualifications

• Proven experience in information security governance, risk management, and compliance, preferably within fintech, payments, or financial sectors.
• Hands-on experience developing or operating an ISMS such as ISO 27001 or SOC 2.
• Strong, practical knowledge of GDPR and UK GDPR compliance and application.
• Familiarity with DORA regulations and EBA ICT risk guidelines.
• Technical understanding of cloud environments, with Google Cloud Platform (GCP) knowledge considered advantageous.
• Excellent written communication skills suitable for regulators, executives, and internal teams.
• Ability to independently prioritize actions that effectively mitigate risks.

Preferred Additional Skills

• Certifications such as CISSP, CISM, CISA, ISO 27001 Lead Implementer or Auditor, CIPP/E, or CIPM.
• Experience participating in banking or payments license applications.
• Knowledge of PCI DSS, KYC/KYB processes, or fraud prevention-related data management.

What We Provide

• A unique opportunity to guide a fintech company’s transition from startup to regulated scale-up and help establish policies foundational to its future as a licensed bank.
• The ability to work with existing strong frameworks, vendor registries, and training programs, advancing them to higher standards.
• A strategic role reporting directly to the CTO and leadership, influencing company-wide growth and security strategy.
• Modern, cloud-native work environments leveraging Google Cloud and AI tools to enable fast and secure operations.