Head of Information Security & DPO

As the Head of Security and Data Protection Officer at NALA, you will play a pivotal role in our mission to increase economic opportunities for migrants across the globe. NALA is a groundbreaking fintech company that aims to build a bank for the migrant diaspora, starting with a focus on remittances. Our goal is to provide innovative financial services and infrastructure that connect migrants living overseas with their loved ones back home. Backed by prominent investors including Y-Combinator, Accel Partners, and notable fintech angel investors, we are poised for rapid growth and success.

In this role, you will lead NALA’s security and data protection strategies, ensuring the resilience of our systems and the privacy of our customers’ information. You will drive our efforts to maintain compliance with global data protection regulations while staying ahead of emerging threats. You’ll be an internal and external champion for security at Nala, and will aid the sales process by liaising with security counterparts for our B2B Rafiki clients. Your expertise in cybersecurity, regulatory frameworks, and risk management will be critical in fortifying NALA’s platform, enabling safe and seamless financial connections between the migrant diaspora and their families back home.

🎯 Your Responsibilities in this Role

Build and own our security strategy

• Design and implement a security roadmap that grows with us, mitigating risk, while enabling the business through a robust security posture.
• Define and maintain security policies, frameworks, and processes to protect data and systems. Not just writing policies but enforcing them. 

Be the security advocate for our customers

• Represent NALA’s security posture to counterparts, banking partners and regulators, addressing customer concerns and showcasing our security posture.
• Working closely with product to ensure that security is part of the process and to ensure customers are kept safe. Liaison between the business and engineering. 

Lead operational security

• Monitor and respond to emerging threats, making sure proactive defenses are always in place.
• Manage and coordinate penetration testing and third-party security audits, ensuring results are turned into actionable improvements.
• Oversee incident response planning and execution, collaborating with internal teams and external partners.
• Putting in a place bounty programme and managing it.

Drive compliance and governance

• Act as our Group Data Protection Officer, ensuring we meet global regulations like GDPR, DORA and others. 
• Lead efforts to achieve and maintain key certifications, such as ISO 27001 and SOC 2.
• Work closely with engineering and product teams to ensure security and privacy are built into our products.

Grow and ead the security team

• While not an immediate ask, over time we expect this role will build a team - when we do, it will be your role to ensure high-performance, with overall responsibility for hiring and mentoring top talent.
• Foster a company-wide security-first mindset through training and awareness initiatives.
  

🔥 Must-Have Job Requirements

Leadership Experience: 

• 10+ years in security roles, with hands-on leadership experience in comparable fintech environments. Bonus points for exposure to payments. 
• Comfortable rolling your sleeves up - while this is a leadership role, it’s also a ‘first-in’ position, and as such, will be relatively hands on to start off with. 

Customer-Facing Expertise: 

• You’ll be comfortable facing off with counterparts from NALA and Rafiki partners during our onboarding process, explaining complex security topics, and ensuring confidence in our overall security positioning

Domain expertise: 

• You’ll need strong knowledge of security tools (SIEMs, firewalls, encryption) and frameworks/models like Zero trust, NIST, SOC2 and ISO 27001.
• You’ll be comfortable working in similar environment to our own - a fast-moving startup that is also regulated in many countries. To set expectations, right now we’re regulated by the FCA in the UK, the DNB in the Netherlands and are currently going through our licensing process in the US.  

Compliance experience: 

• Experience navigating global data protection laws and achieving key certifications (ISO 27001, SOC 2, etc.).

Incident Management: 

• A track record of managing and responding to security incidents effectively. 

Communication Skills: 

• You can translate technical security concepts into clear, actionable insights for teams and stakeholders.

Certifications: 

• CISSP, CISM, or similar are a strong plus but not required.

🤩 What's in it for you

• Salary: Aligned with current market rates for similar roles in the industry.
• 35 Days Off: Enjoy an amazing 35 days of holidays to unwind and explore.
•  Birthday Leave: Celebrate your special day with a bonus day off to take off in that month
•  Learning Budget: Fuel your growth with $1000 annually for learning and development.
•  Hybrid Working: We work 3 days a week in the office (Mon, Wed, Fri)
•  Sarabi: Themed snacks and Friday lunch with a focus on building great working relationships with the team.
•  Global Workspace: Get access to WeWork locations worldwide.
•  Monthly Socials: Join fun social events every month for great times
•  Free Coffee: Enjoy barista-style coffee at your fingertips.
•  Office Fun: Play pool and table tennis when you need a break