Head of Information Security

<div class="content-intro"><div> <h2>Our mission</h2> </div> <div class="bub-content-body"> <div class="field field--name-body field--type-text-with-summary field--label-hidden field__item"> <p>Constructor’s mission is to enable all educational organisations to provide high-quality digital education to 10x people with 10x efficiency.&nbsp;</p> <p>With strong expertise in machine intelligence and data science, Constructor’s all-in-one platform for education and research addresses today’s pressing educational challenges: access inequality, tech clutter, and low engagement of students.</p> <h3><strong>Please send your resume in English only.</strong></h3> </div> </div></div><h3><span data-contrast="none"><span data-ccp-parastyle="heading 1">About&nbsp;</span><span data-ccp-parastyle="heading 1">the</span><span data-ccp-parastyle="heading 1">&nbsp;Role</span></span><span data-ccp-props="{"134245418":true,"134245529":true,"335559738":360,"335559739":80}">&nbsp;</span></h3> <p><span data-contrast="auto">We're&nbsp;looking for&nbsp;a <strong>Head of Cybersecurity </strong>to expand and lead our security function across four areas: application security, security compliance, infrastructure &amp; cloud security, and business application security. You'll take over a small existing security team, with a mandate to grow it as the company scales.</span><span data-ccp-props="{}">&nbsp;</span></p> <p><span data-contrast="auto">This is a hands-on leadership role.&nbsp;You'll&nbsp;set direction and represent security to leadership, but&nbsp;you're&nbsp;also expected to dig into technical detail with engineering, IT, and compliance teams.</span><span data-ccp-props="{}">&nbsp;</span></p> <h3>Duties &amp; Responsibilities</h3> <p><strong><span data-contrast="none"><span data-ccp-parastyle="heading 2">Application security</span></span><span data-ccp-props="{"134245418":true,"134245529":true,"335559738":160,"335559739":80}">&nbsp;</span></strong></p> <ul> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="0" data-aria-level="1"><span data-contrast="auto">Build and run our AppSec program, including agentic/AI-assisted security reviews of code and pull requests</span></li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="0" data-aria-level="1">Integrate security checks into CI/CD pipelines so vulnerabilities are caught before production</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="0" data-aria-level="1">Run developer security training and champion secure coding practices org-wide</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="0" data-aria-level="1">Evaluate and roll out AI coding tools in ways that improve, not undermine, code security<span data-ccp-props="{}">&nbsp;</span></li> </ul> <p><strong><span data-contrast="none"><span data-ccp-parastyle="heading 2">Security compliance</span></span><span data-ccp-props="{"134245418":true,"134245529":true,"335559738":160,"335559739":80}">&nbsp;</span></strong></p> <ul> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="4" data-aria-level="1"><span data-contrast="auto">Own ISO 27001 and SOC 2 certification and ongoing&nbsp;security&nbsp;audits</span></li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="4" data-aria-level="1">Collect requirements from stakeholders and build a roadmap for additional certifications as the business requires them</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="4" data-aria-level="1">Maintain policies, controls, and evidence in a way that scales without slowing teams down<span data-ccp-props="{}">&nbsp;</span></li> </ul> <p><strong><span data-contrast="none"><span data-ccp-parastyle="heading 2">Infrastructure &amp; Cloud Security</span></span><span data-ccp-props="{"134245418":true,"134245529":true,"335559738":160,"335559739":80}">&nbsp;</span></strong></p> <ul> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="7" data-aria-level="1"><span data-contrast="auto">Work closely with our DevOps organization to secure our Kubernetes infrastructure and cloud environments, including sovereign cloud deployments</span></li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="7" data-aria-level="1">Define security standards for infrastructure-as-code, network architecture, and access control</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="7" data-aria-level="1">Partner with Engineering teams on secure-by-default configurations<span data-ccp-props="{}">&nbsp;</span></li> </ul> <p><strong><span data-contrast="none"><span data-ccp-parastyle="heading 2">Business Application Security</span></span><span data-ccp-props="{"134245418":true,"134245529":true,"335559738":160,"335559739":80}">&nbsp;</span></strong></p> <ul> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="10" data-aria-level="1"><span data-contrast="auto">Work closely with IT&nbsp;and Business application&nbsp;teams&nbsp;to secure Microsoft 365 and other line-of-business systems, including CRM and ERP</span></li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="10" data-aria-level="1">Own identity, access, and data protection controls across business applications</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="10" data-aria-level="1">Manage third-party/vendor risk for business-critical SaaS<span data-ccp-props="{}">&nbsp;</span></li> </ul> <h3>Qualifications &amp; Experience:</h3> <ul> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1"><span data-contrast="auto">8+ years in information security, including 3+ years in a leadership role, preferably in all-remote or hybrid international organizations</span></li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1">Track record running application security programs, ideally with CI/CD-integrated tooling and modern (AI-assisted) code review</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1">Hands-on experience with ISO 27001 and/or SOC 2, proven experience leading and successfully completing the audit, not just reading the standard</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1">Experience securing business applications (M365, CRM, ERP) and vendor risk management</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1">Ability to explain risk and trade-offs clearly to both engineers and executives</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1">Comfortable operating with a small team and prioritizing across competing demands</li> <li data-leveltext="-" data-font="Aptos" data-listid="7" data-list-defn-props="{"335551671":0,"335552541":1,"335559685":720,"335559991":360,"469769226":"Aptos","469769242":[8226],"469777803":"left","469777804":"-","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1">Working knowledge of Kubernetes and cloud security; sovereign cloud experience is a plus<span data-ccp-props="{}">&nbsp;</span></li> </ul><div class="content-conclusion"><h2><strong>What We Offer</strong></h2> <ul> <li data-start="199" data-end="1027">💻 Choice of work equipment (e.g., laptop, monitor, etc.)</li> <li data-start="199" data-end="1027">🇬🇧 English classes (iTalki – $130 monthly)</li> <li data-start="199" data-end="1027">⏰ Flexible schedule (we usually work between 09:00/10:00 and 18:00/19:00)</li> <li data-start="199" data-end="1027">👶 Newborn bonus (€500 per child)</li> <li data-start="199" data-end="1027">🧠 Patent remuneration</li> <li data-start="199" data-end="1027">🌴 Paid leave</li> <li data-start="199" data-end="1027">🧑‍💻 Remote work in locations without our offices</li> <li data-start="199" data-end="1027"><strong>Hybrid work in locations with offices (2 days in-office, 3 days remote)</strong></li> </ul> <p><strong>Constructor</strong> fosters equal opportunity for people of all backgrounds and identities. We are led by a gender-balanced board committed to building a