Two
Cyber & Information Security Officer at Two in Glasgow, GB
Job Description
About Two
Two builds the decisioning platform behind B2B commerce. Businesses use our SaaS platform for credit decisioning, identity verification and fraud prevention, so they can say yes to more buyers, faster and more safely. We handle over €1Bn annually across Norway, Sweden and the UK; and we're on the path to becoming a licensed credit institution in Sweden.
The role
We're looking for an Information Security Officer to drive our cyber and data protection programme. You'll own how Two governs information security and personal data across the group — setting the standards, managing the risk, and making sure we can prove it to regulators, clients and auditors.
This is a hands-on, high-ownership role. You'll work closely with our CTO, senior leadership, business and engineering teams. You will have real influence over how a growing, regulated fintech builds security and privacy into everything it does.
What you'll do
Own and evolve our ISMS and security policy framework, aligned to ISO 27001 and DORA
Run cyber and information risk management, from risk assessments to board-level reporting
Lead third-party and ICT supplier risk — tiering, due diligence, DPAs and ongoing review
Lead our EEA-EU GDPR / UK GDPR programme: records of processing, DPIAs, privacy notices, data subject requests and international transfers
Assess incidents and personal data breaches, and act as our point of contact with data protection authorities
Shape the ICT and security side of our Swedish credit institution licence
Answer client security and privacy due diligence with confidence
Run our security and privacy awareness programme for all staff
What you'll bring
Solid experience in information security GRC and/or data protection, ideally in fintech, payments or financial services
Practical experience building or running an ISMS (ISO 27001, SOC 2 or similar)
Strong working knowledge of GDPR / UK GDPR — not just the theory, but how to make it work day to day
Familiarity with DORA or EBA ICT risk guidelines
Enough technical depth in cloud environments (GCP a plus) to challenge engineers credibly
Clear, sharp writing — equally at home drafting a regulator letter, a board update or a Slack message
The confidence to work independently and the judgement to focus on what genuinely reduces risk
Nice to have
CISSP, CISM, CISA, ISO 27001 Lead Implementer/Auditor, CIPP/E or CIPM
Experience supporting a banking or payments licence application
PCI DSS, KYC/KYB or fraud-prevention data experience
What we offer
This is a rare opportunity to take a young fintech from startup to regulated scale-up, laying the policy foundations for our future as a fully operational bank. You'll shape the ICT and security side of Two becoming a licensed credit institution, and you'll deal directly with the regulators as you do it.
Solid foundations with a real mandate. You'll not start from scratch. Our policy framework, vendor register and training programme already exist. We need someone to take them from good to great.
A seat at the table. You'll work directly with our CTO and leadership team. Your judgement will guide the company’s future growth.
Modern ways of working. We run cloud-native on Google Cloud and use AI tools every day. You’ll help us to move fast, safely.
Apply now - and start the journey today!