Cyber Security Governance

Description

The company has been supplying digital tools to businesses in Europe for over 45 years, from small firms to large ones. Its offering covers HR, customer relations, e-invoicing and digital payments.

The Research and Development team drives the group's innovation. It researches and builds new technologies and invests heavily in artificial intelligence to improve its products and services.

This role is a hands-on application security position, not a governance, risk and compliance role. You will work on the software itself, not only on policy.

Responsibilities

• Steer the organisation's application security maturity, with a structured and scalable approach to secure development across teams and products.
• Define, measure and track security KPIs for vulnerability management, such as detection, remediation and exposure time, so risk and progress stay visible over time.
• Lead application security initiatives across the organisation, building security in from the earliest stages of development.
• Help define and update security controls and practices so they match internal standards, regulations and industry frameworks.
• Work with Product Owners and development teams to align security goals with business priorities and build a shared security culture across the software development lifecycle.
• Work closely with engineering teams to define and apply security best practices at every stage of the lifecycle.
• Apply your hands-on expertise in software security, secure architecture, threat modelling and secure development.

Requirements

• Solid knowledge of application security frameworks such as SAMM, ASVS, NIST CSF and similar.
• Understanding of ISO 27000 and of NIS2, DORA, ACN guidelines and PCI-DSS, including how they affect application security.
• Strong grasp of application security design principles: input filtering, encryption in transit and at rest, authentication and authorisation frameworks, and secure-by-design practice.
• Advanced English, C1 level.
• Preferred: knowledge of AI risk and security frameworks such as NIST AI RMF, EU AI Act requirements, ISO/IEC 23894, OWASP Top 10 for LLMs and Google SAIF.
• Preferred: understanding of AI-related risks and the current and emerging AI landscape, with real curiosity about it.
• Preferred: past experience as a software developer or security engineer, with a working grasp of the SDLC and the ability to read and review code.
• Preferred: familiarity with application security testing methods such as SAST, DAST, penetration testing and dependency or vulnerability scanning.

Conditions

Full-time position based in the Milan or Rome office.

Hybrid work: you choose when to come into the office, and go in when working with colleagues adds real value.

Total compensation of € 49.000 to € 63.000, including a variable component tied to performance. Full-time reference.

Equal opportunity applies; all candidates are considered on merit.

Benefits

• A four-day week, with one extra day off every week.
• A personal wellbeing budget of from € 3.850 per year, covering travel, medical costs, parental support, sports, and reimbursement of personal services such as childcare and caregiving.
• Tailored learning paths and real development opportunities within an international group that keeps changing.
• An inclusive workplace built on trust, collaboration and diverse perspectives.
• Work that creates value for people, businesses and communities through digital technology.