Security Lead (Technical Security & Governance)
Invity is a Czech fintech company developing products and services that connect digital assets with traditional financial services. We are licensed as a Crypto-Asset Service Provider (CASP) under the European MiCA regulation and are supervised by the Czech National Bank.
We’re looking for an experienced IT Security Specialist or Lead to help develop and maintain our information security framework, coordinate ICT risks, and ensure compliance with security and regulatory requirements. You’ll also lead a small team of two Security Specialists.
This role primarily focuses on Governance, Risk & Compliance (GRC) and requires a solid understanding of IT and information security. You’ll work closely with the CTO, Engineering, IT, Legal, and Compliance teams to ensure our security processes are practical, effective, and aligned with business needs. We’re looking for someone who can go beyond policies and compliance documentation, understand technical security risks, and work confidently with technical teams. Deep technical specialisation and hands-on administration of security technologies are not required.
👉 What You’ll Do
Security Governance & ISMS
Maintain and improve our Information Security Management System (ISMS)
Develop and update internal security policies, procedures, and documentation
Coordinate the implementation of security requirements across the company
Monitor the effectiveness and implementation of security controls and identify gaps
Prepare regular security reports for management
ICT Risk Management
Coordinate periodic ICT risk assessments and maintain the risk register
Work with asset and system owners to identify and evaluate security risks
Track risk treatment plans and remediation progress
Support information asset classification and ICT service criticality assessments
Prepare documentation for management approval and risk acceptance
Regulatory Compliance & Audits
Collaborate with Compliance and Legal to implement security requirements under DORA, MiCA, and related regulations
Maintain security documentation and evidence of regulatory compliance
Coordinate audit preparation and evidence collection for internal and external audits and regulatory inspections
Track audit findings and remediation actions
Support communication with auditors and supervisory authorities on information security matters
ICT Third-Party Risk Management
Coordinate security assessments of ICT vendors and outsourcing partners
Review vendor security documentation, including SOC 2 reports, ISO 27001 certifications, and security questionnaires
Maintain records of third-party security risks
Collaborate on defining contractual security requirements
Support periodic reassessments of critical and important ICT service providers
Security Incident Governance
Maintain the security and ICT incident management framework
Coordinate incident recording, classification, and documentation
Work with technical teams to assess incident causes, impact, and remediation
Prepare documentation for regulatory incident reporting in collaboration with Compliance
Track corrective and preventive actions following incidents
Access Management & Security Controls
Oversee compliance with identity and access management processes
Coordinate periodic access reviews and onboarding/offboarding control assessments
Document security control reviews and identified gaps
Work with IT and Engineering teams to improve security processes
Business Continuity & Operational Resilience
Coordinate information security aspects of Business Impact Analysis (BIA)
Support Business Continuity and Disaster Recovery documentation
Maintain records and evaluations of ICT operational resilience testing
Track remediation activities following tests and assessments
Security Awareness
Coordinate security awareness training for employees and management
Prepare internal security guidance and educational materials
Help build a practical security culture across the company
💪 What We’re Looking For
At least 4 years of experience in information security, IT risk management, or GRC
Good understanding of information security management principles and standards, particularly ISO 27001 or NIST CSF
Practical experience with security risk assessments and risk register management
Experience developing security documentation, policies, and internal procedures
Understanding of IT environments, cloud services, identity management, and fundamental security controls
Ability to assess technical risks and collaborate effectively with technical teams
Experience with security audits, control reviews, or remediation tracking
Ability to work independently, set priorities, and communicate effectively
Good command of Czech and English
Nice to Have
Previous experience leading a small security team
Experience in regulated industries, particularly fintech or financial services
Knowledge of DORA, MiCA, GDPR, or the Cyber Resilience Act
Experience with ICT third-party risk management and outsourcing
Experience with Business Impact Analysis, Business Continuity Management, or Disaster Recovery
Familiarity with SOC 2, CIS Controls, or other security frameworks
Certifications such as CISM, CRISC, CISA, or ISO 27001 Lead Implementer/Auditor
🤝 What We Offer
The opportunity to develop security governance in a growing, regulated fintech company
An independent role with direct impact on security processes and ICT risk management
Close collaboration with the CTO, Compliance, Legal, and technical teams
Practical experience with European financial regulations and Czech National Bank supervision
Room for initiative and continuous improvement of internal processes
A flexible working environment with a hybrid setup
👋 Sounds good? If you have experience in information security, risk management, or security governance and would like to take the next step in your career, we’d love to hear from you. Submit your CV and a cover letter, and we’ll get back to you after reviewing your application.