About Us_

// At Masabi, we’re driving the fare payment revolution, powering the journeys of millions all over the world. We build fare collection platforms that allow riders to seamlessly buy and present tickets for public transport either on their mobile phones, from a ticket machine, or even by tapping their bank card to travel.

Our Justride platform is used in over 250 locations globally, including some of the largest cities in the world. With our industry-first mobile ticketing SDK, we’ve partnered with large players in the transport space, including Uber, Moovit and Transit.

Your own journey is important to us too. Choosing a role here means joining a network of innovators from all walks of life; a group of passionate individuals who consistently deliver. Here, you’ll find the tools you need to build the career you want. Whether you’re taking the direct route or trying a new path, we’ll support you no matter what.

The Role_

// You will join the Security team at Masabi. Masabi builds Justride, a mobile ticketing and fare collection platform used by public transport authorities and agencies around the world. Our customers trust us with their riders' data and payments, so security and compliance are central to our business.

As a Security Compliance Analyst, you will help us run our security controls consistently and on time. You will own selected control processes from start to finish, carry out reviews, manage third-party risk and support our commercial teams when customers and prospects ask about our security. This role is a good fit for someone who is careful, organised and enjoys finding ways to make repeatable work simpler and more reliable.

You will work with a degree of autonomy, be the go-to person for day-to-day compliance questions, and help set the standard for how evidence, registers and documentation are maintained. You will also support us to make compliance work faster, more consistent and easier to scale through automation and AI. This role is a good fit for someone who is rigorous and pragmatic, and who enjoys turning frameworks and requirements into simple, repeatable processes that people actually follow.

Location_

// This role is only available to candidates based in Romania in a fully remote model.

Responsibilities_

Own a portfolio of assigned security control processes end to end: plan them, carry them out, gather evidence, and follow up on and track any findings until they're resolved with clear ownership.

Perform manual and tool-based security controls, helping us close gaps where controls are missing or not run consistently.

Carry out regular reviews, such as user access reviews, and make sure results and actions are recorded.

Run our Third-Party Risk Management (TPRM) process: assessing new and existing suppliers, reviewing their security posture, tracking risks, and scheduling reassessments.

Maintain the risk registers that keep our security and privacy processes on track (for example supplier, risk, asset, and data processing registers), keeping them accurate and current.

Help analyse security and privacy requirements in bids and tenders from transport agencies, and work with the wider team to prepare clear, accurate answers.

Respond to security questionnaires and information requests from existing customers.

Support audits and certifications (such as ISO 27001, ISO 27017:18, AICPA SOC 2, PCI DSS, NIST CSF and Cyber Essentials) by preparing evidence and documentation.

Look for opportunities to automate or improve control processes, including with AI tools, so they are faster, more consistent and easier to scale.

About You_

Hands-on experience in information security, IT compliance, internal control or audit, where you’ve owned control processes from start to finish rather than only supporting them

Practical experience with audits or assessments against at least two recognised frameworks from ISO 27001, SOC 2, PCI DSS, GDPR or NIST, including mapping controls across them

Solid understanding of access control, risk management, third-party risk and data protection, and of how cloud services and SaaS tools fit together from a security point of view