PCI DSS · NIST
Location: Office First - Berlin
Team description
Our security assurance team keeps SumUp's information security programme credible, both to regulators and to the millions of merchants who trust us with their business. As part of a small global team spanning Europe, Brazil and Chile, you'll help translate frameworks like ISO 27001, PCI DSS and NIST into practical controls that hold up under real audits and real third-party scrutiny. This is a chance to shape how a fast-growing fintech proves its security maturity across multiple regulatory environments at once, with real ownership over the areas you improve.
What you'll do
- Review information security controls, audit findings and risk mitigation plans, working with other teams to put the right fixes in place
- Run third-party due diligence, supplier reviews and contract assessments as part of the third-party risk management process
- Partner with stakeholders across the business to promote strong security practices and help embed security principles into their day-to-day processes
- Support external and internal audits and due diligence requests, responding directly to auditors, clients and partners
- Track relevant laws, regulations and security standards, flagging gaps against SumUp's existing controls
- Help maintain and improve the team's security maturity picture, identifying priority areas and leading or supporting initiatives to close them
You'll be great for this role if...
- Experience reviewing and improving information security controls in a similar assurance or GRC-focused role
- Strong knowledge of informat