Group DPO and Security Compliance Officer

Job description

Confirmo is a stablecoin payment infrastructure provider trusted by market leaders. Founded over a decade ago by crypto natives, we're one of the first crypto payment processors in the world and have built one of the most established infrastructures in the industry. Over the past 4 years, we have been growing exponentially (130+%) and expanding across the U.S., Middle East, and Europe. As part of our continued growth, we are now expanding our legal and compliance team in Prague. Overview: We work with enterprise clients who hold us to the highest standards on security and data protection. Their CISOs run thorough security reviews, they expect certifications like SOC 2, and as a group operating across the EU and the UAE, we take our data protection obligations seriously. We are looking for a senior, hands-on colleague to own both. As Group DPO, you will act as the Data Protection Officer for our Irish and UAE entities and provide data protection services across the group, including handling data subject access requests. As Security Compliance Officer, you will run our ISO 27001 and SOC 2 certifications which are in progress, maintain DORA compliance, maintain the group-level policies and procedures, and represent Confirmo's security posture directly - to regulators, to existing clients, and to prospects who need to be satisfied before they commit. This is not a management role, and it is not a role that hands the work to consultants. You will personally update policies, prepare the evidence, run the audits, and sit on the calls. You will report to our Chief Legal Officer and work alongside the Head of Security, who provides the deep technical context. You do not need to be a technical engineer yourself, but you do need a solid understanding of how modern security works. Key Responsibilities: Own the group's GDPR and UAE data protection compliance: Deal with all aspects of group data protection, act as DPO for our Irish and UAE entities, respond to data subject requests, conduct training, and review and update the group-wide data protection policies and procedures where necessary. Own our certifications: Manage ISO 27001 and SOC 2 across their full lifecycle: controls, evidence collection, audit preparation, liaising with external auditors, and the ongoing re-certification cycle. Help us win clients: Enterprise prospects run security reviews before they sign. You will handle those: questionnaires, due-diligence calls, and whatever the prospect's security team needs. You will work with sales on deals where our certifications are what unlocks the next step. Own our regulatory compliance: Maintain and continuously improve our DORA compliance, and evaluate other security and operational-resilience frameworks and regulations that may apply to the group and review contractual data protection clauses. Write and own all security policies and procedures: Author, maintain, and version the full set of information security policies, standards, and procedures for the entire Confirmo Group, harmonising the requirements of our EU, US, and UAE entities into one coherent framework. Own the Trust Page: Build and maintain the public-facing record of what Confirmo complies with and how. It should be specific enough that a client's security team or a regulator can find what they need without calling us. Represent us to regulators and clients: Lead calls with regulators, auditors, and existing clients where our data protection, security, and compliance programme is under review. You own how Confirmo presents itself in those conversations. Your Profile: Experience as a DPO in the EU: You have worked as a DPO in the EU and are willing to learn about UAE data protection law. Proven, senior GRC track record: Substantial experience (6+ years) owning security governance, risk, and compliance in a regulated, fintech, payments, or technology environment. This is a senior individual-contributor role, and we need someone who has done this before and knows what good looks like. At ease on commercial calls: You can sit across from a prospect's security team or a client's CISO and explain what we do and why it holds up. You do not need the sales team to carry the conversation. Hands-on certification experience: You have personally taken an organisation through ISO 27001 and/or SOC 2. You didn't just oversee a team that did it; you did the scoping, writing, and audit work yourself. Policy and framework authorship: Demonstrated experience writing data protection and security policies and procedures from scratch and mapping controls across multiple frameworks (e.g., GDPR, ISO 27001, SOC 2, DORA, NIST CSF). Regulatory and client-facing confidence: Credible in front of regulators and enterprise clients; able to explain a data protection, security, and compliance programme clearly and stand behind it under scrutiny. Independent and delivery-focused: You work autonomously, take ownership of your work, and see things through to completion without needing close supervision. Working technical literacy: You understand the fundamentals of modern security in a cloud-native company well enough to write about them accurately and discuss them credibly. The Head of Security provides the deeper technical expertise. Excellent English: Fluent written and spoken English is essential; it's our working language. Czech is a plus. Any of these is a plus: Experience in crypto, virtual assets, or stablecoin / payments infrastructure. Familiarity with MiCA and the broader EU operational-resilience and crypto regulatory landscape. Experience running compliance across a multi-jurisdiction group (EU, US, and the Middle East). Relevant certifications (e.g., CISA, CISM, CISSP, ISO 27001 Lead Implementer / Lead Auditor). Experience operating a public Trust Page using tooling such as Vanta, Drata, or similar. Location: Hybrid, based in Prague. This is not a fully remote role. If you are interested in learning more, please submit your CV, and our recruiter will get back to you promptly.