• Define and maintain the information security strategy, standards, and roadmap, aligned to applicable regulations, rules, and security best practices. • Steer security architecture across a cloud-native environment, defining secure-by-design patterns for microservices, APIs, and shared platform services. • Establish and govern secure software development lifecycle (secure SDLC) practices, embedding automated security controls into CI/CD pipelines. • Define and drive adoption of cloud security guardrails - identity, network segmentation, encryption, secrets management, and configuration baselines. • Build and run security monitoring, logging, and threat detection across cloud, infrastructure, and application layers. • Lead the security incident response lifecycle - preparation, detection, containment, eradication, recovery, and post-incident review - and act as incident commander for security events. • Own vulnerability and threat management: scanning, risk-based prioritization, remediation tracking, and reporting across infrastructure, containers, and application code. • Plan and coordinate penetration testing and offensive-security exercises (in-house or co-sourced) and drive findings to closure. • Govern identity and access management, privileged access, and least-privilege principles across cloud and corporate systems. • Define and oversee data protection controls - encryption, key management, data classification, and loss prevention - for sensitive and cardholder data. • Secure corporate IT and office infrastructure, including endpoints, networks, and productivity and collaboration platforms. • Partner with Engineering and DevOps teams to make the secure path the easy path, providing tooling, standards, threat modelling, and design reviews. • Provide security input into architecture and change decisions, including the adoption of new technologies and third-party services. • Run security awareness and phishing-resilience programs for technical and non-technical staff. • Implement and evidence the technical security controls underpinning PCI DSS, ISO 27001, and SOC audits. • Monitor the evolving threat landscape and emerging security technologies. • Act as a key member of the internal security center of excellence and contribute to cross-functional security working groups. • Build, lead, and mentor a small security team. • Report security posture, key risks, and metrics.

• Own security and compliance across product, engineering, cloud, vendors, and internal systems. • Build practical security controls around auth, access, secrets, data privacy, infrastructure, and deployments. • Create safe usage guidelines for AI tools, agents, MCP servers, tool calling, and automation workflows. • Run vulnerability management, security reviews, risk assessments, and incident response planning. • Drive compliance readiness for frameworks like SOC 2, ISO 27001, GDPR, or similar. • Help teams handle sensitive data properly, especially when using AI tools and third-party platforms. • Train the team on secure development, AI safety, privacy basics, and common attack patterns. • Bring a startup mindset: fast decisions, clear ownership, practical fixes, and no security theater.

Role Description inventYOU is looking for Cybersecurity Trainings & Exercises Experts to support the preparation, customisation and delivery of cybersecurity exercises and training activities. The role focuses on: - Cybersecurity trainings - Tabletop exercises - Operational and technical exercises - Awareness activities - Training material preparation - Exercise assessment Key Responsibilities: - Support the preparation and delivery of cybersecurity exercises. - Contribute to tabletop, operational, technical and awareness-raising exercises. - Develop, customise and localise training and exercise material. - Support the use of exercise platforms, systems or digital collaboration tools. - Deliver cybersecurity training sessions for technical and non-technical audiences. - Prepare presentations, case studies, exercises, assessment templates and supporting documentation. - Assess the impact of trainings and exercises through feedback, quizzes or evaluation mechanisms. - Prepare reports, lessons learned and recommendations for improvement. Qualifications - Bachelor’s degree in Computer Science, Computer Engineering or equivalent. - Intermediate level: at least 3 years of relevant professional experience. - Senior level: at least 6 years of relevant professional experience. - Experience in cybersecurity training and/or cybersecurity exercises. - Experience in tabletop, operational, technical or awareness-raising exercises. - Experience in developing, customising or localising cybersecurity training/exercise material. - Ability to prepare scenarios, injects, presentations, case studies, assessment templates or supporting documentation. - Familiarity with exercise platforms, training systems or digital collaboration tools. - Strong communication, presentation and facilitation skills. - Ability to assess training/exercise impact through feedback, quizzes or evaluation mechanisms. - Very good command of English: B2 for Intermediate level, C1 for Senior level. Benefits - Join a people-focused technology company with an international mindset. - Work on challenging projects for European clients and organisations. - Be part of a collaborative and supportive team environment. - Gain exposure to cybersecurity, technology and digital transformation projects. - Develop your skills through hands-on experience and continuous learning. - Work with experienced professionals across different business and technology domains.

• Shipping product strategy and roadmap and aligning it with stakeholders, the company vision, and market trends. • Working directly with customers and the field to understand problems, personas, and gather feedback. • Collaborating with engineering to define and deliver new features. • Working with the product marketing team to develop effective business and market communications.