Senior Information Security Analyst

About us Lucanet is the CFO Solution Platform built for modern finance & tax teams, offering an integrated suite of solutions to simplify and automate their most critical finance processes. More than 6,000 companies around the world rely on our easy-to-use, out-of-the-box SaaS platform - from consolidation and financial planning to tax compliance and reporting, ESG reporting, banking and cash management, and more. PE-backed and growing our footprint across global markets. Behind the platform is a global team of 850+ people who care about doing the work well. We challenge each other to push boundaries, move fast without cutting corners, and build solutions that genuinely change how finance & tax leaders operate. If you’re looking for a place where your work has real reach - and where your growth is part of the deal - this is it. Discover more about Lucanet as an employer. The Role This is a new role created because commercial success is driving more security scrutiny than ever, more enterprise deals, more due diligence, more regulatory expectations. We’ve invested heavily in automation (including agentic AI tooling that handles the bulk of RFP responses), we run mature ISO 27001 and SOC 2 programmes, and we’re already underway with ISO 42001 for AI governance. None of this is broken, it needs to go further. What we need is someone who can handle the last mile: the nuanced security questions that can’t be answered by automation alone, the edge cases that require judgement, the conversations with customers and auditors where clarity and credibility matter. Someone who takes what’s already working and makes it sharper, broader, and more scalable. This role sits within the Information Security function and works across engineering, SRE, product, and go-to-market teams. You won’t just maintain what exists - you’ll push it forward. Lucanet has always operated proactively on security. What’s changed is the landscape: the volume of enterprise deals driving security scrutiny, the regulatory environment accelerating under NIS2 and the EU AI Act, and the pace of AI innovation inside our own product. Scaling compliance-as-engineering to match that pace requires more hands on deck — sharp ones. You’ll shape how Lucanet communicates its security posture to enterprise customers — refining the narrative, not building it from scratch You’ll extend compliance-as-code into continuous auditing, real-time reporting, and automated evidence collection across the business You’ll mature our AI governance programme during the period when standards are still being written — putting Lucanet ahead of the curve You’ll operate across cloud-native AWS infrastructure with modern tooling (Vanta, Orca Security, Aikido, GitHub Actions) You’ll have direct influence on product security improvement initiatives — shaping how security requirements feed into the product roadmap You’ll have access to best-in-class AI tools — Claude, OpenAI, and Gemini — to augment your own work and push the boundaries of what security operations can look like You’ll work in a team that treats experimentation as a feature, not a risk What you’ll do Security assurance & ISMS governance. You’ll own the continuous improvement of Lucanet’s control environment — maintaining and maturing the ISMS, strengthening ISO 27001 and SOC 2 processes, and ensuring audit-readiness remains a permanent state rather than a periodic effort. The foundations are solid; your job is to raise the bar. Customer trust — the last mile. Our agentic RFP tooling handles the bulk of security questionnaire responses at scale. You own what comes after: the complex follow-up questions that need human judgement, the assurance calls where a customer needs to hear a credible voice, and the edge-case scenarios where a templated answer isn’t enough. You’ll also refine the knowledge base that feeds the automation, making each cycle smarter than the last. Compliance-as-code — beyond CI/CD. We already have compliance checks integrated into our development pipelines. You’ll expand that philosophy into other areas of the business: continuous audit monitoring, automated evidence collection for certification cycles, real-time compliance reporting, and programmatic control validation across infrastructure and operations. The goal is compliance that runs continuously, not compliance that happens once a year. AI security & governance. Lucanet’s AI security playbook exists and is evolving. ISO 42001 certification is underway and needs maturity. You’ll drive that forward — working on data lineage, model risk, prompt injection defences, and alignment with the EU AI Act. This isn’t starting from zero; it’s building from a strong foundation into a best-in-class programme. Third‑party risk. You’ll own vendor security assessments, evaluating the risk posture of suppliers and partners and ensuring contractual security requirements are met. Pragmatic risk management. You’ll assess and communicate security risks in a way that enables decisions, not delays them. That means applying risk frameworks (ISO 27005, NIST RMF, or similar) with commercial awareness — understanding when a risk needs mitigation, when it needs acceptance, and when the business just needs a clear answer fast. We don’t want someone who flags everything as critical; we want someone who helps the organisation take smart, balanced risks. Vulnerability management. You’ll collaborate with engineering and SRE to prioritise and track remediation of vulnerabilities, ensuring findings from scanners, pen tests, and bug bounties are closed systematically. What you bring to the table Required 3+ years in information security with a focus on GRC — we’d rather hire someone eager and proactive with less experience than a senior paper-pusher with more Working knowledge of ISO 27001 and at least one of SOC 1, SOC 2, or C5 — you understand the frameworks well enough to have an opinion on how to improve them The ability to translate security controls into language that sales teams, customers, and executives can act on — you can hold a customer assurance call and provide clarity on the spot Hands‑on experience with an ISMS — you’ve contributed meaningfully to maintaining and improving one Familiarity with modern development environments: Git, CI/CD, cloud infrastructure (AWS/Azure/GCP). You don’t need to write production code, but you need to understand how software gets built and deployed A default towards automation — when you see a repetitive process, your instinct is to eliminate it, not optimise it Strong written and spoken English. German is a plus but not required Strongly Valued Experience with compliance‑as‑code approaches — automated evidence collection, continuous monitoring, control validation via APIs Exposure to AI governance, AI risk management, or the emerging regulatory landscape around AI (EU AI Act, ISO 42001, NIST AI RMF) Experience with tools in our stack: Vanta, Orca Security, Aikido Security, GitHub Actions Track record of reducing manual compliance overhead through tooling, templates, or process redesign Experience in a B2B SaaS or financial software environment where customer trust is a sales‑critical factor Relevant certifications (CISA, CISM, CISSP, ISO 27001 Lead Auditor/Implementer) — though we care more about what you’ve built than what you’ve passed Curiosity about AI and a willingness to use it in your own workflows — we provide access to Claude, OpenAI, and Gemini and expect you to leverage them You Don’t Need to Have Done everything on this list — we’d rather hire someone who’s built three of these capabilities brilliantly than someone who’s touched all of them superficially Prior experience in financial software — if you understand SaaS security and compliance, you’ll pick up the domain fast A traditional GRC background — some of the best people in this space came from engineering, consulting, or product security and learned GRC by doing it Powered by uniqueness Everybody’s different here and we like it that way. At Lucanet, we embrace the unique qualities of every person. We are dedicated to creating an inclusive workplace where all employees can thrive and feel valued. Regardless of your gender identity, sexual orientation, personal expression, racial identity, ethnicity, religious belief, or disability statuses, you are welcome at Lucanet just as you are. Our recruitment process is solely based on qualifications, merit, and organizational needs, ensuring fairness and equal opportunities for all candidates. We recognize that every person brings a unique blend of skills and experiences. If you believe you will excel in this role, we want to hear from you – even if you do not check every box on the list. We only want to know why you are great for this role, so please avoid including your picture, age, and marital status in your CV. Learn more about our DE&I journey GDPR Notification Please follow the provided link to understand how we comply with GDPR requirements and what measures we take to ensure your data is safe. Data protection Lucanet #J-18808-Ljbffr