About The Company

Calamatta Cuschieri Moneybase plc is a privately held Fintech Group that operates in Investment Services, Fund Administration, Online Investing, and Payments. With roots dating back to 1971, the Group today is evolving at a fast pace whilst keeping the same core principles, that of providing clients the best service using the latest technology and the top professionals in their field, whilst ensuring the strong governance and ethics.

We are committed to attracting and selecting the very best people to join our team and to creating a workplace that promotes individual career growth; we value our people and their well-being. The group employs over 210 people from over 27 countries around the world with Assets Under Management and Administration of over 3 billion.

About The Role

The Chief Information Security Officer (CISO) is responsible for leading the Group’s information security, cyber risk, and resilience strategy across the organisation. Reporting to the CEO, the CISO will provide strategic direction and executive oversight on all matters relating to cybersecurity, security governance, operational resilience, and technology risk.

This role is central to ensuring that the organisation’s systems, data, and infrastructure are protected through a strong and proportionate security framework that supports business growth, regulatory compliance, and operational stability.

The CISO will work closely with the CTO and technology teams to embed security by design, strengthen cyber resilience, and maintain a high standard of security across the Group.

The successful candidate will combine strategic leadership with strong technical knowledge and a sound understanding of security standards, and will play a key role in shaping a security-conscious culture while overseeing security operations, risk management, incident response, and infrastructure security.

Duties & Responsibilities

Strategy, Leadership & Executive Oversight

Define, lead, and continuously enhance the organisation’s cybersecurity and resilience strategy, aligned to business objectives
Develop and maintain the cybersecurity roadmap and manage the budget
Act as executive owner of cyber risk forming part of the IT steering committee
Manage cybersecurity and infrastructure programme delivery, resources, and priorities

Governance, Risk & Compliance

Establish and maintain the organisation’s security governance framework aligned to DORA, PCI-DSS, and recognised security standards including ISO27001, NIST, and CIS
Define and implement, with the support of the GRC team, an ICT and information security risk frameworkan enterprise risk management framework and risk appetite, and oversee the identification, assessment, and management of information security and ICT risks across the organisation
Oversee third-party and vendor risk management programmes, including DORA ICT third-party risk requirements
Define, review, communicate, and enforce security policies, standards, and procedures
Oversee change management from a security perspective

Security Operations & Incident Management

Establish and oversee security operations, including SOC, SIEM, and enterprise security monitoring
Lead incident detection, response, recovery, and reporting capabilities
Act as executive lead during any cybersecurity incidents
Oversee incident investigations, root cause analysis, remediation activities, and cyber incident response plans to protect IT assets, data, intellectual property, and company reputation
Continuously improve threat intelligence, detection, and response processes

Security Architecture, Infrastructure & Technical Controls

Conduct a thorough review of the current IT infrastructure and security posture, and embed security-by-design across all business and technology initiatives
Define and oversee enterprise security architecture across cloud, infrastructure, applications, and data
Take ownership of all security-related systems and controls, including identity and access management (IAM)
Implement and maintain CIS Critical Security Controls
Define the CIS Controls baseline and assure its implementation by technology teams
Drive the adoption of modern security practices and technologies, including Zero Trust, EDR, cloud security, and emerging threat intelligence capabilities

Resilience, Disaster Recovery & Business Continuity

Own the resilience framework and test programme, and assure DR readiness Ensure disaster recovery (DR) and business continuity (BCP) plans are implemented, maintained, and tested in line with DORA resilience requirements
Align cybersecurity with the enterprise resilience strategy and ensure preparedness for major disruption scenarios

Security Culture & Awareness

Lead organisation-wide security awareness and training programmes
Promote and embed a strong security culture across the organisation

Team Leadership & Cross-Functional Coordination

Lead, manage, mentor, and develop the Systems and Security teams, overseeing staffing, performance management, and capability development
Build and maintain a high-performing cybersecurity and infrastructure function with clear roles, responsibilities, and accountability
Coordinate employees, contractors, and vendors, and cross-functional initiatives involved in security initiatives IT security and infrastructure operations

Assurance, Metrics & Continuous Improvement

Conduct periodic security audits and assessments
Track and report security KPIs, risk metrics, and resilience maturity indicators
Maintain a current understanding of the evolving cyber threat and regulatory landscape
Provide independent challenge and assurance over technology operations
Agree security SLAs and metrics with the CTO and report performance against them

Experience Requirements

Proven experience in a senior information security leadership role, ideally as a Chief Information Security Officer, Head of Information Security, or equivalent
Significant experience within financial services, fintech, banking, payments, or another highly regulated environment
Strong track record of developing and implementing cybersecurity strategies, governance frameworks, and security transformation programmes
Demonstrated experience in cyber risk management, security operations, incident response, and enterprise security architecture
Experience working with recognised frameworks and standards such as ISO27001, NIST, CIS, PCI-DSS, and DORA
Experience leading or supporting ISO27001 certification and broader regulatory compliance initiatives
Strong understanding of operational resilience, disaster recovery, business continuity, and third-party risk management
Experience overseeing security across cloud environments, infrastructure, applications, identity and access management, and data protection controls
Proven experience engaging with executive committees, boards, regulators, auditors, and other senior stakeholders
Experience building, leading and developing high-performing security teams, and influencing technology teams without direct line authority.Experience building, leading, and developing high-performing teams across security and infrastructure functions

Skills & Competencies

Strong strategic thinking with the ability to align cybersecurity priorities to business goals
Strong leadership and people management skills, with the ability to lead, motivate, and develop teams
Excellent communication and stakeholder management skills, including the ability to influence at executive and board level
Sound judgement and decision-making skills, particularly in high-pressure or incident-driven situations
Strong analytical and problem-solving capabilities, with the ability to assess risk and define practical mitigation plans
Good understanding of modern security practices and technologies, including cloud security, Zero Trust, EDR, SIEM, SOC, and IAM
Ability to balance commercial priorities, operational needs, and regulatory requirements
Strong organisational and programme management skills, with the ability to manage multiple priorities effectively
High level of integrity, accountability, and professionalism

Qualifications

Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Information Technology, or a related field
Relevant professional certifications such as CISSP, CISM, CRISC, ISO27001 Lead Implementer or Lead Auditor, or equivalent
Additional qualifications would be considered an asset

What We Offer

As an HR certified employer, we invest in our people through clear career paths, benefits and opportunities for professional development.

A structured introduction to financial advisory services with support from experienced advisors.
Study leave and qualification sponsorship, as applicable.
Internal training on our products, systems and compliance procedures.
A defined development path towards Junior Advisor once the qualification and progression requirements are met.

All applications will be treated with the strictest confidentiality.

By submitting this application, I confirm that all the information given by me in this application for employment and any additional documents attached hereto are true to the best of my knowledge and that I have not wilfully suppressed any material fact. I confirm I have disclosed if applicable any previous employment with Calamatta Cuschieri Moneybase Plc. I accept that if any of the information given by me in this application is in any way false or incorrect, my application may be rejected, any offer of employment may be withdrawn or my employment with Calamatta Cuschieri Moneybase Plc may be terminated summarily or I may be dismissed. By submitting this application, I agree that my personal data will be processed in accordance with Calamatta Cuschieri Moneybase Plc's Candidate Privacy Notice

Chief Information Security Officer (CISO)

Job Description