Manager - Information Security (Compliance)

Job Description

At Basware, we deliver mission-critical cloud solutions that empower organizations to unlock their full potential. Our products are designed to bring clear and compelling value to our customers, and we’re looking for talented and forward-thinking professionals who can help us shape the future of our technology.

We are seeking a Manager - Information Security (Compliance), an experienced security compliance specialist who thrives at the intersection of governance, risk management, and stakeholder engagement. In this role, you will help ensure that Basware maintains a robust and effective security compliance program while supporting customers, auditors, suppliers, and internal teams with practical, risk-based guidance.

The Information Security Compliance team supports the organisation in maintaining an effective, risk-based information security management system. The Manager - Information Security (Compliance) will coordinate key compliance, assurance and risk management activities, working closely with business and solution owners to strengthen security governance, support audit readiness and drive continual improvement.

Customer and stakeholder assurance

• Manage the Security Advisory process, including completion of due diligence questionnaires, requests for information and general information security queries from customers, prospects, partners and customer-facing colleagues.

• Provide practical information security and compliance advice to colleagues, projects, solution owners and business stakeholders, escalating material risks where appropriate.

Risk, supplier assurance and business continuity

• Conduct and support third-party information security risk assessments and periodic supplier reviews, documenting findings, risks, recommendations and follow-up actions.

• Maintain the information security risk register, coordinate periodic risk reviews, monitor treatment actions and support the CISO and risk owners in recording clear, proportionate and current risk information.

• Support business continuity activities, including assisting business owners with the completion and review of Business Impact Analyses and tracking related actions.

Audit and corrective action management

• Plan, coordinate and perform internal information security audits, record audit evidence and findings, and monitor agreed corrective actions and opportunities for improvement.

• Support external audits and assurance activities by coordinating evidence, engaging relevant control owners and responding to auditor queries.

• Agree appropriate corrective actions and implementation dates with control owners, and proactively support delivery to ensure agreed timelines are achieved.

Compliance initiatives and awareness

• Develop appropriate security training and communications that promote a positive information security culture.

• Manage assigned compliance initiatives and improvement activities, maintaining clear plans, priorities, dependencies and stakeholder communications.