Information Security Specialist

We are looking for an Information Security Specialist to strengthen our approach to cyber and business security. We need an expert who can embed security by default into our IT services, working closely with our IT Operations and Application Management teams. We are actively integrating AI automation into relevant areas of the business and expect candidates with mindset focused on improving efficiency and deliver a better user experience. Work format is hybrid: 3 days on-site, 2 days remote. More than 6 years of hands-on experience in information security or IT infrastructure, with a strong technical background — this is what allows the Specialist to review configurations and logs credibly, even though the role itself is not hands-on. Solid understanding of web and mobile application vulnerabilities and secure coding practices (e.g., OWASP Top 10), Ability to identify, explain, and mitigate risks based on the OWASP framework, familiarity with OWASP ASVS (Application Security Verification Standard) for security requirements and testing. Practical knowledge of ISO 27001 and the CIS Critical Security Controls (CIS18) or similar frameworks; experience running or supporting internal or external security audits. Working knowledge of SIEM concepts and tools (e.g., Graylog, Splunk, Elastic, Microsoft Sentinel), secure SDLC / DevSecOps practices, vulnerability management, EDR, and identity and access management. Understanding of Zero Trust architecture principles and how to sequence their adoption. Strong written English and the ability to produce clear, business-facing documentation and recommendations.  Beneficial: Experience in multi-product SaaS or consumer software company. Prior exposure to GDPR or data-privacy work is an advantage. Familiarity with CrowdStrike Falcon, Invicti, or comparable EDR / vulnerability-scanning tools. Relevant certifications (e.g., CompTIA Security+, CSSLP, CISM, ISO 27001 Lead Auditor/Implementer, CISA or analogs).