Security Officer

Key Responsibilities

Strategic Leadership

• Define, maintain, and implement the Goelett information security strategy, aligned with business goals and regulatory requirements.


• Establish and maintain the Goelett information security governance framework, ensuring consistent policies across all subsidiaries.


• Advise the Goelett Board on cyber risk posture, security investments, emerging threats, and data protection implications.


• Ensure & enforce alignment between cybersecurity strategy and GDPR/data privacy strategy.

Security Operations & Risk Management

• Lead cyber defense operations (SOC, incident response, threat intelligence).


• Ensure business continuity and disaster recovery plans are robust and tested across all entities.


• Oversee data protection and privacy programs in compliance with GDPR and global privacy laws (including NIS2, ePrivacy, and equivalent non-EU regulations).


• Drive risk assessments, DPIAs (Data Protection Impact Assessments), and penetration testing programs; ensure timely remediation of vulnerabilities.


•  Ensure privacy-by-design and security-by-design are embedded into all products, features, and technologies.

Regulatory, Client Assurance & DPO Responsibilities

• Own the group’s compliance with international standards (ISO 27001, PCI DSS, SOC2, GDPR, NIS2, etc.).


• Act as the official Data Protection Officer for Goelett, serving as the primary point of contact for data subjects and supervisory authorities.


• Monitor internal compliance, conduct regular GDPR audits, and ensure proper documentation (RoPA, retention policies, consent mechanisms, data processing agreements).


• Oversee handling of data subject rights (access, deletion, rectification, portability, objection).


• Advise on lawful bases for processing, cross-border data transfers, sensitive data processing, and anonymisation/pseudonymisation measures.


• Engage with regulators, auditors, and major clients on security and data privacy matters.


• Provide data privacy and security assurance for RFPs, tenders, and client due diligence processes.

Team, Culture & Training

• Foster a security-first and privacy-first culture across the group through awareness and continuous training.


• Partner with Product, Engineering, Legal, HR, and Operations to ensure continuous alignment between technical practices and data protection obligations.


• Lead and mentor security & privacy teams and coordinate with local privacy champions across subsidiaries.

Key Qualifications & Experience

• Proven experience (10+ years) in senior Information Security roles, including at least 5 years as a Security Officer, DPO, or equivalent in a SaaS or technology-driven organization.


• Strong expertise in GDPR and global privacy regulations; prior experience as a designated DPO is highly preferred.


• Deep knowledge of security frameworks, compliance standards, and regulations (ISO 27001, SOC2, GDPR, PCI DSS, NIS2, etc.).


• Experience managing global/multi-country operations and distributed teams.


• Expertise in cloud security (Azure, AWS, Kubernetes, CI/CD pipelines) and data privacy engineering (DLP, encryption, key management, consent systems).


• Strong understanding of threat intelligence, incident response, DPIAs, and crisis management.


• Exceptional communication skills with ability to engage Board, C-level stakeholders, regulators, and major clients.


• Certifications such as CISSP, CISM, CISA, CCISO, CIPP/E, CIPM are strongly preferred.


• Fluency in English required; French or German is a plus.

Key Leadership Competencies

• Strategic Vision


• Executive Presence


• Operational Excellence


• Influence & Collaboration


• Resilience & Crisis Leadership


• Ethical & Regulatory Stewardship (specific to DPO responsibilities)