Information Security Manager

While we welcome applications from everywhere, please note that at this stage we are prioritizing candidates who are already based

in Stockholm and eligible to work in Sweden without visa sponsorship.

At Bambuser, we’re helping some of the world’s most recognized brands transform how they sell online through live shopping,

shoppable video, and interactive commerce experiences. Brands including L’Oréal, Audi, Sephora, and Sonos use our platform to

create richer and more engaging customer experiences.

As a global B2B SaaS company working with enterprise customers, trust matters at every stage of our business. Customers need to

know that their data is handled responsibly. Teams need clear and practical guidance. Auditors need evidence that our controls

work. As technology and regulation evolve, particularly around AI, our security practices need to keep pace.

Bambuser already has strong security foundations, including an ISO 27001-certified information security management system (ISMS).

Your challenge will be to build on them as our business, customer expectations, and the regulatory landscape continue to evolve.

You’ll own our ISMS, including the information security Risk and Asset Registers, and partner with our General Counsel on the

security side of privacy compliance. Day to day, you’ll help the business meet its regulatory obligations, keep our policies

practical and current, and make sure we stay audit-ready year-round. Compliance and audit readiness are outcomes of doing security

right, not ends in themselves.

We’re a fast-moving scale-up, so we need you to think the way we all try to think: what can be automated, templated, or scheduled

instead of done by hand again? If you find yourself doing the same manual task twice, build the system that makes sure nobody has

to do it a third time. The goal is to cut busywork, yours and everyone else’s, so time goes to the work that truly needs a human.

You’ll be part of our Operations team, reporting to the VP Operations and working closely with Legal, Engineering, IT Ops, and our

commercial teams.

• ISMS Governance & Audit Readiness

Own the ISO 27001 certification lifecycle and annual ISMS calendar, keeping recurring activities on track, from training and

management reviews to nonconformities and corrective actions. Maintain the information security Risk and Asset Registers,

keeping risks connected to business priorities. Run internal and external audits end to end: scoping, evidence collection,

stakeholder coordination, and remediation.

• Keeping Policies Sharp, Not Just Compliant

Own the full ISMS library and right-size policies to our actual risk profile. Build policies, playbooks, and control

documentation that hold up under scrutiny and work in practice. Drive adoption through clear communication and practical

guidance, so policies become part of how people work.

• The Face of Security to Customers and Vendors

Be the go-to contact for enterprise customer security reviews, RFP security sections, and the Trust Center. Lead the rollout of

our RFP AI tool. On the procurement side, review new tools and vendors, including AI tools, for data handling, access, and

integration risk before adoption.

• Regulation, Privacy and AI

Partner with Legal to track regulation across our markets and translate relevant requirements into concrete security controls

with clear internal ownership. Support the security side of privacy compliance, including vendor data handling reviews and

inputs to the Record of Processing Activities (ROPA) and Data Protection Impact Assessments (DPIAs). Assess security risks

associated with AI tools and help keep our AI usage guidelines current.

• Security Testing and Training That Sticks

Coordinate penetration testing engagements with vendors and Engineering, from scoping and arranging access to tracking findings

through remediation. Own our security awareness training program and content, designing and delivering onboarding and recurring

sessions that stay relevant as threats and regulations shift.

• Automation and Ownership

Turn security workflows into documented, automated processes. Work with IT Ops and other teams on evidence collection, control

monitoring, training reminders, audit scheduling, and recurring tasks. Help teams understand and own their part in keeping

Bambuser secure.

• Experience: 5+ years in information security compliance, IT audit, or risk management, ideally in B2B SaaS or another

fast-growing tech company.

• ISO 27001: A track record of implementing or maintaining ISO/IEC 27001 certifications. Experience running or supporting

penetration testing programs is a plus.

• Privacy and regulation: Strong working knowledge of GDPR and how security controls support privacy compliance in multi-tenant

SaaS environments, plus an awareness of evolving AI regulation, including the EU AI Act, and its implications for a tech

business.

• Technical grounding: Comfortable mapping systems, data flows, and integrations, and advising on the security implications of

architecture changes.

• Automation instinct: Hands-on experience automating evidence collection or control monitoring and evaluating GRC platforms

against building solutions in-house. Comfortable with workflow automation, scheduling tools, and AI-assisted drafting.

• Communication: You translate technical security risk into business terms, whether you’re speaking to executives, enterprise

customers, or a room full of people at a training session.

• Proactive and solutions-oriented: You identify risks, spot patterns, and anticipate future needs, rather than waiting for

problems to surface.

You’ll join a focused, hungry team that enjoys working together and getting things done. We move quickly, help one another, and

give people room to take ownership.

Here, your contribution will be visible and felt across the company. You’ll help teams make informed decisions, build trust with

enterprise customers, and create security practices that support how we grow.

You’ll have solid foundations to build on, an experienced team around you, and the opportunity to shape how information security

works at Bambuser.