Principal Information Security Manager

Who you are

• 5+ years of hands-on InfoSec experience in a SaaS or B2B tech company
• Proven ownership of ISO 27001 and/or SOC 2 programs
• Track record of representing InfoSec to enterprise customers, including security reviews and escalations
• Must be fluent in English
• Comfortable with AI-driven tooling; actively looks for automation opportunities in compliance and operations
• Experience supporting or preparing for M&A or investor due diligence processes
• Background working alongside Legal, Procurement, and Engineering
• Practical understanding of cloud security architecture (enough to challenge and validate, not operate)
• Relevant certification: CISM, CISSP, ISO 27001 Lead Auditor/Implementer, or equivalent. Certification matters less than what you have built

What the job involves

• Our information security program is fit for purpose and operationally sound. The next chapter is about making it investor-ready, AI-efficient, and capable of sustaining enterprise customer trust at scale
• This is not a build-from-scratch role. It is a step up in maturity: fewer manual processes and sharper governance
• The position sits at the center of the InfoSec team; you coordinate across teams, own outcomes and represent the function. You are comfortable being the person customers and auditors talk to
• You think in programs and systems, not tasks. You identify where manual effort can be replaced by tooling or AI-assisted workflows, and are empowered to drive that change as we build out our AI-driven operating model across the company
• You will act as the senior deputy for InfoSec within our Finance & Operations department, owning the function day-to-day, representing it internally and externally, and making it run with less friction and more intelligence
• You report directly to the SVP Business Operations & Transformation and work closely with Legal, Procurement, Engineering, external auditors and enterprise customers
• Lead ISO 27001 and SOC 2 audit cycles end-to-end in preparation, evidence collection, auditor management, and findings remediation
• Own the control framework and ensure it stays current as the business evolves
• Prepare the InfoSec program for investor and M&A due diligence scrutiny
• Own the response to enterprise customer security questionnaires and RFPs
• Represent Staffbase credibly in customer security reviews, calls, and audits
• Build scalable approaches (automation, templates, knowledge base) to reduce response time without sacrificing quality
• Maintain the risk register and drive risk treatment decisions with relevant stakeholders
• Own vendor security assessments for critical and high-risk suppliers
• Partner with Procurement and Legal on AI-assisted review workflows
• Own the internal security policy framework, keep it current, understandable, and enforced
• Design and run security awareness programs that change behaviour, not just tick boxes
• Own the incident response plan and lead execution when incidents occur
• Coordinate with Engineering, Legal, and leadership during incidents
• Drive post-incident reviews and close findings with owners