At Inriver, we help brands deliver better product experiences - everywhere their customers are. From the first product detail to the final purchase decision, we make product information work smarter. When our platform is secure, our teams ship with confidence and it enhances customer trust. More than 1,600 global brands trust their product data with us.Now we‚Äôre looking for a hands-on Head of Security, Compliance & IT to take over from our outgoing CISO and lead the next chapter of our Enterprise Security, Product Security, Privacy, Compliance and internal IT function.

About The RoleYou‚Äôll own our security strategy and roadmap - and you‚Äôll deliver it. You‚Äôll lead a small, sharp team across Security and IT, work through a 24/7 managed detection and response partner, and partner with engineering teams that own the security of the code they write. You‚Äôll be the person our customers, our leadership team and our auditors talk to about security. You‚Äôll work from our HQ office in Malm√∂, supporting our remote locations in Stockholm, Amsterdam, Davao and Manila.

Internal IT sits in this role too - the Microsoft 365 and Entra ID estate, device management, identity lifecycle, our SaaS portfolio and IT cost. That‚Äôs deliberate. Most of what makes a company secure - identity, access, endpoints, joiner-mover-leaver, patching - is IT work, so one owner means those foundations get built properly rather than negotiated between two functions.

This is a high-impact role reporting to the CFO, working closely with the wider leadership team, Legal and HR. You‚Äôll be close enough to the work to be credible with engineers, and hands-on when it counts - but you won‚Äôt be triaging every alert, and we‚Äôve built the operating model so that you don‚Äôt have to.

Why you‚Äôll love this role üíô

Own Enterprise Security, Product Security, Privacy, Compliance and internal IT end-to-end, across a global, PE-backed mid-size SaaS company
A mandate that‚Äôs already agreed. Our gate-and-block operating model - security gates that can hold a release - is signed off by the CEO, CTO and CPO. Not a best-effort understanding.
24/7 monitoring is funded. We‚Äôre onboarding a managed SOC/MDR partner. Non-major incidents are handled by them, not by you at 3am.
Engineering owns its own findings, remediated against SLAs you agree together. You build the gates and the capability; you don‚Äôt chase tickets.
You‚Äôre not the risk owner of last resort. Material cyber risk is accepted by the business leaders whose decisions create it, and your escalation path doesn‚Äôt stop at your manager.
Run a modern Microsoft Azure security stack, a real product-security program embedded in our SaaS SDLC, and compliance across SOC 2, ISO 27001, ISO 27701, GDPR, NIS2, the EU Data Act and the EU AI Act

What you‚Äôll do

Set the security strategy and roadmap - and deliver it. Build a multi-year plan grounded in business risk, get it funded, and lead the initiatives in it to completion.
Be the security partner to Engineering. Embed secure SDLC, threat modelling and SAST/SCA/DAST in our pipelines, set the quality gates, and agree the remediation SLAs product teams work to.
Lead vulnerability management and penetration testing. Scope and commission internal and third-party testing across web application, API and cloud, manage the specialists who run it, and drive findings to closure.
Own the security posture of our Azure environment. Harden our infrastructure (Entra ID, Defender for Cloud, Sentinel, Conditional Access, PIM, Key Vault, Purview, Azure RBAC) and lead our Cloud Security Engineer so our product runs on secure architecture.
Run internal IT as a foundation, not a help desk. Own the M365 and Entra ID estate, device management, identity and access lifecycle, and the IT experience of our people across five locations - including the joiner-mover-leaver and access review processes our certifications depend on.
Own the SaaS estate, IT procurement and IT cost. Rationalise what we run, negotiate what we buy, and keep spend defensible.
Lead major security incidents as a core member of the Security Incident Response Team - coordinating our response, our partner, Legal and the leadership team, through to the lessons learned that stop it happening twice. Our managed SOC handles everything below that threshold, including out of hours.
Run our compliance program end-to-end across ISO 27001, ISO 27701, SOC 2 Type 2 and GDPR, plus NIS2, the EU Data Act and the EU AI Act. Take ISO and SOC 2 audits to the finish line.
Own enterprise risk, third-party risk, BCP/DR and security awareness, with vendor due diligence and contractual safeguards run in close collaboration with Legal.
Be our voice on security with customers. Represent Inriver in customer and prospect engagements, and partner with Sales, Legal and Customer Success on RFPs, security reviews, contractual discussions and enterprise due diligence - keeping our Trust Center an accurate reflection of what we actually do.
Own the Security, Compliance and IT budgets, including staffing - and make sure material cyber risk reaches the CFO, the executive team and the board when it needs to.

What you‚Äôll bring

We don‚Äôt expect you to tick every single box, but for this role we do need most of the following:

‚úîÔ∏è Proven track record of developing and implementing security strategies and roadmaps with real business impact - not a control framework on paper.

‚úîÔ∏è 5+ years in information security, software engineering or similar, with at least 2 years in a senior leadership role (Head of Security, CISO or equivalent) in a mid-size SaaS, cloud or product company.

‚úîÔ∏è Excellent stakeholder management and communication skills - you can explain security posture and risk to management so they can act on it.

‚úîÔ∏è Leadership and coordination of major security incidents. You‚Äôve run the response, not just been in the room.

‚úîÔ∏è Leadership of compliance audits (ISO 27001 and/or SOC 2 Type 2), end-to-end.

‚úîÔ∏è Experience presenting the company to customers - security reviews, RFXs and enterprise due diligence.

‚úîÔ∏è Development and implementation of application security and cloud security programs.

‚úîÔ∏è Deep, current knowledge of Microsoft Azure infrastructure and Azure security, plus strong IT management experience across Microsoft services (Entra ID, Intune/MDM, M365), SaaS administration, identity lifecycle and IT cost management.

‚úîÔ∏è Strong, current knowledge of GDPR, NIS2, the EU Data Act and the EU AI Act.

‚úîÔ∏è Experience leading and developing small, technical teams within a constrained budget - and the willingness to do operational, hands-on work alongside them.

‚úîÔ∏è Excellent written and spoken business English, eligibility to work in the EU, and based within commuting distance of our Malm√∂ office for hybrid on-site work.

Nice to have‚úîÔ∏è Working with an outsourced SOC/MDR and with external pen testers

‚úîÔ∏è Vetting and leading the implementation of SAST/SCA/DAST tooling

‚úîÔ∏è Privacy and data protection

‚úîÔ∏è Third-party risk, BCP/DR or security awareness programs

‚úîÔ∏è Generative and agentic AI security

‚úîÔ∏è Operating across multiple geographies, including the US and the Philippines

‚úîÔ∏è Recognised certifications such as CISSP or CISM

Why Inriver üíô

At Inriver, you‚Äôll join a global company with a product at the centre - and people who genuinely care about building something meaningful together.

In our Malm√∂ office, you‚Äôll find things like:

Tuesday Fika‚òï
Friday breakfasts to start the day together
A running club and social activities for anyone who wants to join
A welcoming mix of focused work, collaboration, and a few laughs along the way

We work in a hybrid setup, with flexibility and trust as a baseline.

Ready to apply? üì¨We‚Äôd love to hear from you. If you‚Äôre curious but not 100% sure, we still encourage you to apply. We‚Äôre happy to explore the fit together!

Inriver is a global leader in Product Information Management (PIM), helping more than 1,600 brands create outstanding product experiences. Behind our success is a team of talented, collaborative, and passionate people who enjoy solving complex challenges and making an impact for customers around the world.

Headquartered in Malm√∂, Sweden, we have colleagues across multiple locations globally, bringing together diverse perspectives, expertise, and experiences. For more information, visit www.inriver.com or follow us on LinkedIn.

Why you‚Äôll love this role üíô

Own Enterprise Security, Product Security, Privacy, Compliance and internal IT end-to-end, across a global, PE-backed mid-size SaaS company
A mandate that‚Äôs already agreed. Our gate-and-block operating model - security gates that can hold a release - is signed off by the CEO, CTO and CPO. Not a best-effort understanding.
24/7 monitoring is funded. We‚Äôre onboarding a managed SOC/MDR partner. Non-major incidents are handled by them, not by you at 3am.
Engineering owns its own findings, remediated against SLAs you agree together. You build the gates and the capability; you don‚Äôt chase tickets.
You‚Äôre not the risk owner of last resort. Material cyber risk is accepted by the business leaders whose decisions create it, and your escalation path doesn‚Äôt stop at your manager.
Run a modern Microsoft Azure security stack, a real product-security program embedded in our SaaS SDLC, and compliance across SOC 2, ISO 27001, ISO 27701, GDPR, NIS2, the EU Data Act and the EU AI Act

What you‚Äôll do

Set the security strategy and roadmap - and deliver it. Build a multi-year plan grounded in business risk, get it funded, and lead the initiatives in it to completion.
Be the security partner to Engineering. Embed secure SDLC, threat modelling and SAST/SCA/DAST in our pipelines, set the quality gates, and agree the remediation SLAs product teams work to.
Lead vulnerability management and penetration testing. Scope and commission internal and third-party testing across web application, API and cloud, manage the specialists who run it, and drive findings to closure.
Own the security posture of our Azure environment. Harden our infrastructure (Entra ID, Defender for Cloud, Sentinel, Conditional Access, PIM, Key Vault, Purview, Azure RBAC) and lead our Cloud Security Engineer so our product runs on secure architecture.
Run internal IT as a foundation, not a help desk. Own the M365 and Entra ID estate, device management, identity and access lifecycle, and the IT experience of our people across five locations - including the joiner-mover-leaver and access review processes our certifications depend on.
Own the SaaS estate, IT procurement and IT cost. Rationalise what we run, negotiate what we buy, and keep spend defensible.
Lead major security incidents as a core member of the Security Incident Response Team - coordinating our response, our partner, Legal and the leadership team, through to the lessons learned that stop it happening twice. Our managed SOC handles everything below that threshold, including out of hours.
Run our compliance program end-to-end across ISO 27001, ISO 27701, SOC 2 Type 2 and GDPR, plus NIS2, the EU Data Act and the EU AI Act. Take ISO and SOC 2 audits to the finish line.
Own enterprise risk, third-party risk, BCP/DR and security awareness, with vendor due diligence and contractual safeguards run in close collaboration with Legal.
Be our voice on security with customers. Represent Inriver in customer and prospect engagements, and partner with Sales, Legal and Customer Success on RFPs, security reviews, contractual discussions and enterprise due diligence - keeping our Trust Center an accurate reflection of what we actually do.
Own the Security, Compliance and IT budgets, including staffing - and make sure material cyber risk reaches the CFO, the executive team and the board when it needs to.