Head of Information Security

# Head of Information Security Amsterdam### Where you'll  is a rapidly growing tech scale-up, active since 2022, redefining how creators and fans connect worldwide. Behind the scenes, this means tackling complex challenges: scaling a high-traffic platform, ensuring content safety with advanced screening and building privacy-first tools that balance compliance with user freedom.### The role

We are looking for a proactive, hands on Head of Information Security who takes real ownership of security at  You set the direction, but you also roll up your sleeves: you review code with our engineers, step in when something goes wrong and keep things practical rather than  a growing company like ours, security only works when everyone understands why it matters.

You work across the whole company, not just with the development team: with our support and safety teams on escalations, with leadership on risk and with every colleague on awareness. From our engineers to our office manager, you make sure everyone knows what good security looks like in their daily work. In the near future, you will also lead our journey towards ISO 27001 certification.###

Responsibilities
* Strategy and governance
** Develop, implement and maintain practical information security policies aligned with our business goals, without unnecessary bureaucracy.
* Assess security risks, maintain the risk register and advise leadership on mitigation strategies.
* Oversee security evaluations of third party suppliers and keep track of data flows to external vendors.
* Prepare and guide the ISO 27001 certification process, building an ISMS that fits the size and pace of our organisation.
* Hands on security engineering
** Perform regular code reviews to identify, document and remediate vulnerabilities (such as the OWASP Top 10 and business logic flaws).
* Partner with software engineers to design secure services, API integrations and database interactions.
* Integrate SAST, DAST and dependency scanning into our CI/CD pipelines.
* Design and implement robust Identity and Access Management (IAM) for internal and customer facing systems.
* Act as our go to expert on cryptography, token authentication, secure session handling, and cooperate with legal and compliance on matters such as legally required security measures, privacy and data protection and the secure use of AI within the organisation.
* Incident response and escalations
** Lead incident response: preparation, detection, containment and thorough reviews afterwards.
* Take the lead in escalations, working closely with our support team and safety team, and prevent escalations where possible by managing risks early.
* Work with our partner on device management and endpoint security, including MDM rollout and EDR/XDR monitoring.
* Set up threat intelligence and dashboards to report monthly on security posture, incidents and threat vectors.
* Security awareness across the company
** Take the whole organisation along in security awareness, translating technical risks into clear and practical guidance that every colleague understands.
* Build a security culture where people know what to do and feel comfortable raising concerns.### What you bring
* Strong interpersonal skills and organisational sensitivity: you can explain security to a developer, a support agent and a founder, each in their own language.
* Proven ability to drive organisational change and implement security measures that people actually adopt.
* Leadership in escalations, combined with a preventive mindset.
* Proactive and self directed: you see what needs to be done and act on it without waiting to be asked.
* 5+ years of practical experience in software development or security engineering, with a focus on Python, Node and API…