Chief Information Security Officer (CISO)

About Us

UMO is a stealth-mode FinTech venture aiming to evolve the way people experience money by building a unified, AI-powered, yet deeply human money platform across fiat, crypto, and investments – subject to regulatory approvals. The platform is being designed to break down traditional barriers to money across access, assets, and experience, enabling simpler, more adaptive ways for people to interact with financial services.

We are currently developing our MVP and navigating licensing requirements, with a multidisciplinary team of 100+ people representing 20+ nationalities. With our headquarters in the UAE, we are united behind a shared ambition and a relentless focus on serving our customers.

About this role

As a part of our team, you'll help us shape a platform that works for One — a business owner, an artist, a freelancer. In this role, you will act as the executive owner of UMO’s Information Security Management System (ISMS) and Technology Risk Management Framework, reporting to the CTO and collaborating closely with senior management and Chief Risk Officers. We provide the room for you to exercise true executive autonomy and security leadership, chairing the Information Security Steering Committee (ISSC), stripping away corporate friction, and building a resilient, zero-trust security architecture across our modern money platform end-to-end.

You'll take ownership of:

- Governance, Strategy & ISMS: Serve as the executive owner of our Technology Risk Management Framework, Information Security Policy Suite, and ISMS, ensuring full alignment with global security standards and regulatory obligations.

- Executive & Board Reporting: Provide structured reporting to the Boards, ISSC, and Executive Committee (ExCo) regarding organizational risk posture, control effectiveness, incident statuses, and residual risks.

- Regulatory Compliance & Incident Response: Oversee compliance with regulatory cybersecurity reporting, managing material incident notifications (24h), detailed assessment reports (72h), and leading incident response affecting trading engines, APIs, and cloud infrastructure.

- Asset & Threat Risk Governance: Lead the asset classification process based on CIA (Confidentiality, Integrity, Availability) scores, manage the Technology Risk Register, and approve risk treatment strategies alongside threat and vulnerability identification (OWASP Top 10, pentesting, threat intelligence).

- Security Controls & BCP/DRP: Implement and monitor preventive/detective controls (MFA, network segmentation, RBAC, SIEM, IDS/IPS) while coordinating Business Continuity (BCP) and Disaster Recovery (DRP) plans.

- Stakeholder Management & Culture: Build and lead the Information Security function, driving a "security-first" culture across engineering, product, and operations while maintaining strong relationships with regulators, auditors, and key partners.

- AI-Augmented Security Workflows: Model modern execution practices by actively leveraging AI security tooling (Cursor, Claude, ChatGPT) to accelerate threat modeling, policy synthesis, and log analysis automation.

About you:

- Executive Cybersecurity Leadership: You bring extensive experience (10+ yrs) in Information Security, Cybersecurity, or Technology Risk roles, with a proven track record reporting directly to Boards, ExCo, and regulatory bodies.

- ISMS Framework Depth: You bring proven, hands-on experience implementing and maintaining enterprise ISMS frameworks aligned with ISO 27001, NIST, or comparable standards.

- Cloud & API Ecosystem Security: You possess deep technical knowledge of cloud security architectures (AWS, GCP, or Azure), hybrid cloud environments, zero-trust principles, and API-based integrations.

- Regulated Domain Context: You bring deep experience operating inside regulated financial environments (FinTech, virtual assets, payment processors, or neobanking platforms).

- Crisis Management & BCP Resilience: You demonstrate exceptional calm and leadership during high-pressure incident situations, driving continuous visibility through pentesting, continuous scanning, and log analysis.

- Autonomous & Principled Ownership: You manage complex risk targets comfortably, making clear risk treatment decisions (Mitigation, Transfer, Acceptance, Avoidance) and co-approving high-risk residuals alongside executive leads.

- Transparent & Collaborative Culture: You communicate complex technical security concepts effortlessly to both technical teams and non-technical stakeholders, driving mutual respect and an absolute zero-tolerance policy for rudeness.

- Linguistic Fluency: You speak and write English fluently to confidently align global regulators, executive boards, and cross-functional engineering teams.

Can get you a few bonus points:

- Industry Certifications: Preferred professional certifications such as CISSP, CISM, CRISC, or ISO 27001 Lead Implementer/Auditor.

- Crypto & Digital Asset Security: Hands-on experience securing cryptographic wallet architectures, MPC infrastructure, or smart contract execution environments.

- Pre-Launch Startup Scaleup Experience: Practical experience building an enterprise security program from zero to one inside a high-growth pre-launch venture.

The UMO Standard

- Mandate & Ownership: Full ownership of the information security organization and technology risk roadmap, collaborating directly with the Board and Executive Committee.

- Equity: A meaningful equity stake in a venture built from zero to one.

- Location & Flexibility: Base yourself in Lisbon, Dubai with openness to remote for the right fit.

- Impact & Ownership: Your work directly shapes the product and company direction — not just executes it.