Head of Cyber Security (Poland/Remote) at ZEN.COM · Krakow

ZEN.COM is a smart financial app designed for your everyday life – at home and on the go. We make payments, online shopping, and personal finance management fast, secure, and effortless. With ZEN.COM, you can enjoy cashback on purchases, full control over your spending, and peace of mind thanks to purchase protection. A built-in multi-currency account lets you spend abroad or shop internationally with great exchange rates and no hidden fees.

We are looking for a Head of Cyber Security to lead the practical implementation and day-to-day operation of cyber security across our fintech organization.

This is a First Line of Defense (1LoD) role, focused on building, implementing, and operating cyber security capabilities within the business and technology organization.

The role will be responsible for building the security team, developing and maintaining technical security capabilities, establishing technical standards, and ensuring that security solutions are effectively implemented and continuously improved across the organization.

We are looking for a hands-on security leader who combines strong technical expertise with operational ownership and a builder's mindset. The ideal candidate will be comfortable creating a security function, selecting and implementing the right technologies, establishing effective processes, and working directly with engineering and infrastructure teams to improve the organization's security posture.

This is not a second-line control, oversight, or independent assurance role. The focus is on building and running security, taking ownership of implementation, and enabling the organization to operate securely, rather than independently reviewing, auditing, or challenging security activities delivered by other teams.

Requirements:

• Several years of experience in cyber security, including experience leading a technical security function or managing a security team.
• Strong experience operating in the First Line of Defense (1LoD), with direct accountability for building, implementing, and operating security capabilities.
• Experience in fintech, digital banking, payment services, or other environments handling sensitive financial data.
• A proven builder's mindset, with experience establishing security processes, selecting and deploying security technologies, and developing technical capabilities from the ground up.
• Proven experience building teams, recruiting security specialists, and developing technical capabilities.
• Strong technical knowledge of IT infrastructure, networking, operating systems, cloud environments, application security, and modern technology architectures.
• Hands-on experience with security tools and technologies such as SIEM, EDR/XDR, vulnerability management, IAM/PAM, CSPM, WAF, and security automation platforms.
• Experience managing vulnerabilities, responding to security incidents, investigating threats, and coordinating remediation activities.
• Proven ability to define technical security standards and drive their practical implementation.
• Experience working closely with Engineering, DevOps, Cloud, Infrastructure, or Platform teams to deliver security improvements.
• Ability to assess security tools and solutions, make technical decisions, and manage implementation priorities, effectiveness, and costs.
• Strong problem-solving skills and the ability to balance security requirements with business needs and delivery speed.
• Familiarity with security frameworks and standards such as NIST CSF, ISO 27001, CIS Controls, and OWASP.
• Understanding of regulatory and industry requirements relevant to fintech, such as DORA and PCI DSS, where applicable.
• We would appreciate it if you could share your Gallup test or similar assessment results, if available. You can find a dedicated link in the application form on the next page.

Nice to Have:

• Experience building a security function or scaling a security team in a growing organization.
• Experience with cloud-native architectures and modern application delivery environments.
• Experience implementing DevSecOps, Secure SDLC, Security by Design, and automated security testing.
• Experience working in environments subject to financial services regulations and demanding security requirements.

Responsibilities:

• Build and lead the Cyber Security team: Recruit security professionals, define the team structure and required skill sets, establish priorities, and develop the team's technical capabilities.
• Own day-to-day security operations: Take first-line ownership of the practical execution of security activities, ensuring that security measures are implemented, maintained, and continuously improved.
• Build and implement security capabilities: Establish the technical foundations, tools, processes, and operating model required to secure the organization's systems, applications, infrastructure, and data.
• Define and maintain technical security standards: Establish practical security requirements and work with technology teams to implement them consistently across infrastructure, applications, cloud environments, and engineering processes.
• Own security tooling: Evaluate, select, implement, configure, and maintain security tools. Ensure they are properly integrated, effective, and consistently used across the organization.
• Manage vulnerabilities and remediation: Establish and run vulnerability management processes, prioritize findings based on risk, and work with technical teams to implement remediation.
• Drive application and infrastructure security: Build and improve application security, cloud security, identity and access management, endpoint protection, network security, and secure configuration practices.
• Embed security into engineering processes: Work closely with Engineering, DevOps, Cloud, IT, and Product teams to integrate security into software development, CI/CD pipelines, infrastructure changes, and system design.
• Manage technical security risks: Identify weaknesses, assess their practical impact, prioritize mitigation activities, and implement proportionate security measures.
• Improve security processes and automation: Develop operational procedures, automate repetitive security tasks, and improve the effectiveness and scalability of security operations.
• Partner with Risk and Compliance: Translate applicable regulatory and policy requirements into practical technical security measures, working collaboratively with second-line functions while retaining first-line ownership of implementation.
• Drive continuous improvement: Monitor the effectiveness of security solutions, identify capability gaps, and develop a roadmap for strengthening the organization's security capabilities.
• Lead incident response: Develop incident response capabilities, coordinate technical activities during security incidents, and ensure lessons learned are translated into concrete improvements.

What we offer:

• Real influence on shaping the ZEN.COM.
• Work in an environment where innovation and effectiveness truly matter.
• Competitive salary and flexible working conditions.
• Private medical healthcare.
• Internal and external training opportunities.