Information Security Manager, EU (2026)

About the role

Lightspark is building its European operations in Tallinn, Estonia, after acquiring Striga, to connect fiat and crypto payment rails. It is looking for a hands-on Information Security Manager to set up and maintain the security and compliance framework in Europe, ready for Estonian and EU regulatory requirements such as DORA and ISO27001. The role works with the engineering team and U.S. and EU advisors, and requires regular in-office presence.

Key responsibilities

• Develop, implement and monitor an information security and ICT risk management program aligned with DORA, ISO27001 and EU/Estonian requirements.
• Own the Information Security Management System (ISMS), keeping policies, controls and documentation in line with regulation and business needs.
• Deploy and manage technical safeguards across cloud, on-premises and application environments, including vulnerability management, system hardening and incident response.
• Work with global engineering, risk and compliance functions so security standards are applied consistently.
• Identify, assess and manage ICT risks across business units and give security advice on new technologies.
• Act as main point of contact (or with control functions) for regulators, auditors and external security assessors.
• Brief management and, where applicable, the Supervisory Board on key risks, compliance status and improvements.
• Run employee awareness and training to promote a security culture.

Required profile

• 5+ years in information security operations or management, with proven implementation of security and compliance programs.
• Experience in ICT risk management and oversight of technical security functions.
• Higher education in a STEM or business-related field.
• Full working proficiency in English and Estonian.
• Proactive, structured, detail-oriented leader with project management, communication and collaboration skills.
• Certifications such as CISSP, CISM, ISO27001 Lead Implementer or CIPP/E are beneficial; experience with ISO27001 audits or fractional CISO/DPO roles is a plus.

Required skills

• Cloud environments (AWS, Azure, GCP), secure configuration, vulnerability management, monitoring and incident response.
• Security engineering practices, Linux/Windows hardening, networking and scripting (e.g. Python, Bash).
• Knowledge of EU/Estonian frameworks: DORA, ISO27001, SOC2 and GDPR.

What we offer

• Gross monthly base salary of EUR 4,840 - 5,680, depending on experience and skills.
• Annual performance bonus and equity.