Head of Information Security

# Head of Information SecurityAmsterdam### Where you'll workF2F.com is a rapidly growing tech scale-up, active since 2022, redefining how creators and fans connect worldwide. Behind the scenes, this means tackling complex challenges: scaling a high-traffic platform, ensuring content safety with advanced screening and building privacy-first tools that balance compliance with user freedom.### The roleWe are looking for a proactive, hands on Head of Information Security who takes real ownership of security at F2F.com. You set the direction, but you also roll up your sleeves: you review code with our engineers, step in when something goes wrong and keep things practical rather than bureaucratic.In a growing company like ours, security only works when everyone understands why it matters. You work across the whole company, not just with the development team: with our support and safety teams on escalations, with leadership on risk and with every colleague on awareness. From our engineers to our office manager, you make sure everyone knows what good security looks like in their daily work. In the near future, you will also lead our journey towards ISO 27001 certification.### Responsibilities*Strategy and governance** Develop, implement and maintain practical information security policies aligned with our business goals, without unnecessary bureaucracy.* Assess security risks, maintain the risk register and advise leadership on mitigation strategies.* Oversee security evaluations of third party suppliers and keep track of data flows to external vendors.* Prepare and guide the ISO 27001 certification process, building an ISMS that fits the size and pace of our organisation.*Hands on security engineering** Perform regular code reviews to identify, document and remediate vulnerabilities (such as the OWASP Top 10 and business logic flaws).* Partner with software engineers to design secure services, API integrations and database interactions.* Integrate SAST, DAST and dependency scanning into our CI/CD pipelines.* Design and implement robust Identity and Access Management (IAM) for internal and customer facing systems.* Act as our go to expert on cryptography, token authentication, secure session handling, and cooperate with legal and compliance on matters such as legally required security measures, privacy and data protection and the secure use of AI within the organisation.*Incident response and escalations** Lead incident response: preparation, detection, containment and thorough reviews afterwards.* Take the lead in escalations, working closely with our support team and safety team, and prevent escalations where possible by managing risks early.* Work with our partner on device management and endpoint security, including MDM rollout and EDR/XDR monitoring.* Set up threat intelligence and dashboards to report monthly on security posture, incidents and threat vectors.*Security awareness across the company** Take the whole organisation along in security awareness, translating technical risks into clear and practical guidance that every colleague understands.* Build a security culture where people know what to do and feel comfortable raising concerns.### What you bring* Strong interpersonal skills and organisational sensitivity: you can explain security to a developer, a support agent and a founder, each in their own language.* Proven ability to drive organisational change and implement security measures that people actually adopt.* Leadership in escalations, combined with a preventive mindset.* Proactive and self directed: you see what needs to be done and act on it without waiting to be asked.* 5+ years of practical experience in software development or security engineering, with a focus on Python, Node and API security.* Comfortable in CI/CD: SAST/DAST/SCA integration, IaC review and cloud (AWS).* Deep technical understanding of application security, secure code design and API security.* Experience running or building an ISMS (ISO 27001 or NIST CSF), ideally in a small or medium sized organisation. Experience guiding an ISO 27001 certification is a strong plus.* Nice to have: experience with MDM, EDR/XDR endpoint monitoring and zero trust solutions.* Fluency in English and Dutch is a plus.### What we offerA competitive salary and excellent secondary benefits.Flexible working hours and hybrid work options.24 vacation days.Fully paid pension plan.Free lunch at the office.NS Business Card.Personal development budget of €1,000 per year.Gym subscription via ClassPass or a sports venue of your choice.Lease-a-bike scheme.A small, high-trust team that values collaboration and innovation.The chance to work on a fast-growing global platform.A no-politics environment with room for creativity and speed.An inclusive culture where your ideas and expertise truly count.Salary€6,000 – €9,500 per monthLocationAmsterdamEmploymentPart-timeHours32-40 hours per weekResidencyDutch residents only
#J-18808-Ljbffr