{"id":760752,"url":"https://alion.io/job/emerchantpay-information-security-lead","title":"Information Security Lead","company":{"id":172196,"name":"emerchantpay","domain":"emerchantpay.com","url":"https://alion.io/company/emerchantpay","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"D","score":53,"open_postings":14,"ghost_share":0.786,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sofia, Bulgaria"],"countries":["BG"],"hiring_countries":["BG"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":42000,"max_usd":109000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":753},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"AWS Bedrock","optional":false},{"name":"CI/CD","optional":false},{"name":"Configuration Management","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"NIST CSF","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true}],"status":"live","first_seen_at":"2026-06-29T00:00:00Z","employer_posted_date":"2026-06-29","last_verified_at":"2026-10-29T01:42:47Z","board_verified":true,"closed_at":null,"days_open":122,"trust":{"level":"ghost","repost_count":0,"flags":["stale","company_stale"],"days_open":121},"description":"emerchantpay is a leading global payment service provider and acquirer for online, mobile, in-store and over the phone payments. Our global payments solution is available through a simple integration, offering a diverse range of features, including global acquiring, global and local payment methods, advanced fraud management and performance optimisation. We empower businesses to design seamless and engaging payment experiences for their consumers.\nWe are looking for an experienced Information Security Lead to own the design, implementation, and continuous improvement of information security across our cloud-native, DevOps-driven engineering environment, as well as our corporate IT and office infrastructure.\nThe role combines hands-on technical delivery with security leadership. The Information Security Lead will set security direction and personally drive its execution - securing our cloud platform, delivery pipelines, and microservices, leading security operations and incident response, and embedding security into how engineering builds and ships.\nThe role works closely with Engineering, DevOps, and the IT Governance, Risk & Compliance (GRC) function.\nThe role has a strong focus on AWS and cloud-native security across a modern microservices architecture.\nResponsibilities\n Define and maintain the information security strategy, standards, and roadmap, aligned to applicable regulations, rules, and security best practices.\nSteer security architecture across a cloud-native environment, defining secure-by-design patterns for microservices, APIs, and shared platform services.\nEstablish and govern secure software development lifecycle (secure SDLC) practices, embedding automated security controls into CI/CD pipelines.\nDefine and drive adoption of cloud security guardrails - identity, network segmentation, encryption, secrets management, and configuration baselines.\nBuild and run security monitoring, logging, and threat detection across cloud, infrastructure, and application layers.\nLead the security incident response lifecycle - preparation, detection, containment, eradication, recovery, and post-incident review - and act as incident commander for security events.\nOwn vulnerability and threat management: scanning, risk-based prioritization, remediation tracking, and reporting across infrastructure, containers, and application code.\nPlan and coordinate penetration testing and offensive-security exercises (in-house or co-sourced) and drive findings to closure.\nGovern identity and access management, privileged access, and least-privilege principles across cloud and corporate systems.\nDefine and oversee data protection controls - encryption, key management, data classification, and loss prevention - for sensitive and cardholder data.\nSecure corporate IT and office infrastructure, including endpoints, networks, and productivity and collaboration platforms.\nPartner with Engineering and DevOps teams to make the secure path the easy path, providing tooling, standards, threat modelling, and design reviews.\nProvide security input into architecture and change decisions, including the adoption of new technologies and third-party services.\nRun security awareness and phishing-resilience programs for technical and non-technical staff.\nImplement and evidence the technical security controls underpinning PCI DSS, ISO 27001, and SOC audits.\nMonitor the evolving threat landscape and emerging security technologies.\nAct as a key member of the internal security center of excellence and contribute to cross-functional security working groups.\nBuild, lead, and mentor a small security team.\nReport security posture, key risks, and metrics.\nRequirements\nBachelor’s or master’s degree in computer science, information security, or a related field, or equivalent practical experience.\n At least 10 years in information / cyber security, including a minimum of 2-3 years in a leadership role, with hands-on experience securing cloud-native environments at scale.\nDeep, practical public-cloud security knowledge (AWS strongly preferred): identity, networking, encryption, logging, and configuration management.\nStrong experience securing DevOps / CI/CD pipelines and modern microservices architectures - containers, APIs, and infrastructure-as-code.\nWorking knowledge of application security and secure SDLC across modern programming languages and web frameworks.\nHands-on experience with security operations, incident response, and vulnerability management.\nSolid understanding of security frameworks and compliance standards relevant to payments: ISO 27001, PCI DSS, SOC 2, and NIST CSF.\nWorking AI security literacy, with hands-on use of AI-assisted security tooling (e.g., GenAI coding assistants, AI-augmented SAST/DAST and SIEM/SOC analytics) and a practical understanding of securing AI/LLM and agentic applications, including AWS AI services such as Amazon Bedrock and the OWASP Top 10 risks for LLMs (e.g., prompt injection and data leakage).\nStrong analytical and problem-solving ability, with high integrity and sound judgement.\nExcellent verbal and written communication skills, fluent English, and the ability to influence engineers with data, logic, and best practices.\nConsidered as an Advantage\nProfessional certification such as CISSP, CCSP, OSCP, AWS Security Specialty, or CISM.\nExperience in a payments, fintech, banking, or other regulated environment.\nFamiliarity with operational-resilience expectations (e.g. DORA-style requirements).\nExperience standing up a security function.\nBenefits\nFast-growing payment company;\nExcellent working conditions, casual atmosphere, and state-of-the-art hardware;\nModern, challenging, constantly growing business;\nProfessional development - books, trainings, certifications, etc.;\nTeam buildings and fun activities;\n25 days paid holiday, 1 day for every 2 years with us;\nFully distributed and remote.\nIf you are interested, please apply with your CV in English only. Only short-listed candidates will be contacted.\nPersonal data of the applicants will be processed in strict confidentiality by emerchantpay ltd. UIC 175117520 solely for the purposes of selection and recruitment and will not be transferred to other data controllers unless required by law. Applicants provide their personal data on a voluntary basis and will have the right to access and correct their personal data within a reasonable time upon filing a written request.\nemerchantpay is an equal opportunity employer. We appreciate people with different backgrounds and mindsets, and we honor diversity and inclusion.","description_format":"text","description_chars":6571,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Professional development"],"hiring_locations":[{"name":"Bulgaria","iso":"BG","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Payment Processing & Gateways"],"lifecycle":[{"event":"open","at":"2026-09-11T18:26:58Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.295,"p_room":0.28,"age_days":121,"expected_fill_days":39,"reasons":["conf:5","stale_co","ghost","win:tail","crowd:"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/emerchantpay-information-security-lead","json_url":"https://alion.io/job/emerchantpay-information-security-lead.json","meta":{"generated_at":"2026-10-29T04:00:24Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6132,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":172196},"rest":"https://alion.io/mcp/rest/get_company?id=172196"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Femerchantpay-information-security-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Femerchantpay-information-security-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Femerchantpay-information-security-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/emerchantpay-information-security-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Femerchantpay-information-security-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":760752}},{"tool":"search_jobs","arguments":{"company":"emerchantpay.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":760752},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}