Information Security Manager

While we welcome applications from everywhere, please note that at this stage we are prioritizing candidates who are already based in Stockholm and eligible to work in Sweden without visa sponsorship. We are Bambuser, and we are reshaping commerce Video has quickly become one of the most powerful ways for brands to engage, inspire, and convert consumers. At Bambuser, we’re helping some of the world’s most recognized brands transform how they sell online through live shopping, shoppable video, and interactive commerce experiences. Brands including L’Oréal, Audi, Sephora, and Sonos use our platform to create richer and more engaging customer experiences. As a global B2B SaaS company working with enterprise customers, trust matters at every stage of our business. Customers need to know that their data is handled responsibly. Teams need clear and practical guidance. Auditors need evidence that our controls work. As technology and regulation evolve, particularly around AI, our security practices need to keep pace. That’s where you come in. About the role Bambuser already has strong security foundations, including an ISO 27001-certified information security management system (ISMS). Your challenge will be to build on them as our business, customer expectations, and the regulatory landscape continue to evolve. You’ll own our ISMS, including the information security Risk and Asset Registers, and partner with our General Counsel on the security side of privacy compliance. Day to day, you’ll help the business meet its regulatory obligations, keep our policies practical and current, and make sure we stay audit-ready year-round. Compliance and audit readiness are outcomes of doing security right, not ends in themselves. We’re a fast-moving scale-up, so we need you to think the way we all try to think: what can be automated, templated, or scheduled instead of done by hand again? If you find yourself doing the same manual task twice, build the system that makes sure nobody has to do it a third time. The goal is to cut busywork, yours and everyone else’s, so time goes to the work that truly needs a human. You’ll be part of our Operations team, reporting to the VP Operations and working closely with Legal, Engineering, IT Ops, and our commercial teams. Main duties and responsibilities ISMS Governance & Audit Readiness Own the ISO 27001 certification lifecycle and annual ISMS calendar, keeping recurring activities on track, from training and management reviews to nonconformities and corrective actions. Maintain the information security Risk and Asset Registers, keeping risks connected to business priorities. Run internal and external audits end to end: scoping, evidence collection, stakeholder coordination, and remediation. Keeping Policies Sharp, Not Just Compliant Own the full ISMS library and right-size policies to our actual risk profile. Build policies, playbooks, and control documentation that hold up under scrutiny and work in practice. Drive adoption through clear communication and practical guidance, so policies become part of how people work. The Face of Security to Customers and Vendors Be the go-to contact for enterprise customer security reviews, RFP security sections, and the Trust Center. Lead the rollout of our RFP AI tool. On the procurement side, review new tools and vendors, including AI tools, for data handling, access, and integration risk before adoption. Regulation, Privacy and AI Partner with Legal to track regulation across our markets and translate relevant requirements into concrete security controls with clear internal ownership. Support the security side of privacy compliance, including vendor data handling reviews and inputs to the Record of Processing Activities (ROPA) and Data Protection Impact Assessments (DPIAs). Assess security risks associated with AI tools and help keep our AI usage guidelines current. Security Testing and Training That Sticks Coordinate penetration testing engagements with vendors and Engineering, from scoping and arranging access to tracking findings through remediation. Own our security awareness training program and content, designing and delivering onboarding and recurring sessions that stay relevant as threats and regulations shift. Automation and Ownership Turn security workflows into documented, automated processes. Work with IT Ops and other teams on evidence collection, control monitoring, training reminders, audit scheduling, and recurring tasks. Help teams understand and own their part in keeping Bambuser secure. Requirements Experience: 5+ years in information security compliance, IT audit, or risk management, ideally in B2B SaaS or another fast-growing tech company. ISO 27001: A track record of implementing or maintaining ISO/IEC 27001 certifications. Experience running or supporting penetration testing programs is a plus. Privacy and regulation: Strong working knowledge of GDPR and how security controls support privacy compliance in multi-tenant SaaS environments, plus an awareness of evolving AI regulation, including the EU AI Act, and its implications for a tech business. Technical grounding: Comfortable mapping systems, data flows, and integrations, and advising on the security implications of architecture changes. Automation instinct: Hands-on experience automating evidence collection or control monitoring and evaluating GRC platforms against building solutions in-house. Comfortable with workflow automation, scheduling tools, and AI-assisted drafting. Pragmatism : You turn complex requirements into workflows that don’t grind the business to a halt. Communication: You translate technical security risk into business terms, whether you’re speaking to executives, enterprise customers, or a room full of people at a training session. Proactive and solutions-oriented: You identify risks, spot patterns, and anticipate future needs, rather than waiting for problems to surface. Bonus: Experience working in or with publicly listed companie