Ambition has no passport. That belief is why LemFi exists. We're the financial engine for people the world wasn't built to serve, the millions who move countries to build something better and find the financial system hasn't caught up with them yet. We started with remittances: the money people send home to the people they love. Now we run multi-currency accounts, Savings, eSIMs and Credit. Because staying connected to home and building somewhere new are not two separate things. They never were.

The Role

Our Irish entity is regulated by the Central Bank of Ireland, and that brings DORA with it. We're hiring our Head of InfoSec & ICT Risk Europe to own it: the ICT risk control function, our information security management system, and the relationship with the Central Bank on everything security and resilience.

This is a governance and control seat, not an engineering one. Our security engineers build and break things. You set the framework they build against, prove it works, and have the evidence ready before anyone asks for it.

You'll do it with automation, not spreadsheets. If a control can be monitored by a tool, it should be, and you'll be the one wiring those tools into our stack. Based in Dublin, one day a week in our Dublin office, reporting to our CTO.

How You'll Contribute

Own our DORA ICT risk management framework end to end: policies, risk appetite, control library and the annual review that goes to the board.

Act as our independent ICT risk control function, giving engineering and the business real second line challenge rather than sign-off.

Be the Central Bank of Ireland's point of contact on information security, ICT risk and operational resilience, from information requests and inspections to remediation plans.

Run major ICT incident classification and reporting within DORA timelines, working with engineering on root cause and making sure fixes land.

Own ICT third-party risk: the register of information, due diligence and contract terms for critical providers, and exit plans that would actually work.

Run our digital operational resilience testing programme, from scoping vulnerability assessments and scenario tests to tracking findings to closure.

Automate compliance. Integrate GRC tooling with our cloud, identity, HR and ticketing systems so controls are monitored continuously, not evidenced once a year.

Own information security policy, awareness training and the ISMS, aligned to ISO 27001.

Turn our security and resilience posture into reporting the board, leadership team and regulator can act on: key risk indicators, the risk register and the decisions needed.

Partner with our security engineers, who own the hands-on build, translating regulatory requirements into clear, testable controls.

Who You Are

You've owned information security or ICT risk governance at a Central Bank of Ireland regulated firm, ideally in payments, e-money or fintech, and dealt with the Central Bank directly.

You know DORA from doing it, not from a training course. You've built the register, classified real incidents or stood up the framework yourself.

You're a builder at a scaling company, not a maintainer in an enterprise. You'd rather automate a control than add a process step.

You're technically credible. You understand cloud, identity and software delivery well enough to challenge engineers and spot evidence that doesn't stack up, without needing to be hands-on.

You write for boards and regulators the way they want to read: short, specific and decision-led.

You take ownership. A Central Bank finding is yours to close, not someone else's problem.

You have grit. You keep moving when the regulation is ambiguous and the deadline isn't.

You use AI tools daily and you're always looking for ways to apply them to GRC work.

What You'll Bring

7+ years in information security, ICT risk or technology risk, with at least 3 in a regulated financial services firm.

Working knowledge of DORA and its technical standards, plus Central Bank of Ireland expectations on operational resilience and outsourcing.