Chief Information Security Officer

We're not just building an ecommerce platform. We’re reshaping how fashion & lifestyle brands scale globally.

Our API-first, headless SaaS platform supports over 300 brands in delivering localized, high-performance shopping experiences across 120+ countries. Backed by a 50 million SEK investment from the H&M Group, we power leading names like COS, ARKET, & Other Stories, Weekday, Nudie Jeans, and Paul Smith. Brands trust Centra to run operations in 20+ markets - a reflection of the platform’s flexibility and efficiency.

Important note: Prior CISO title not required. We are looking for an experienced security leader (e.g., Head of Security, InfoSec Lead) who can bridge hands-on technical execution and high-level security strategy.

Why Join Centra?

• Product-First Engineering Culture: Join a true SaaS product company backed by an elite platform engineering team, modern toolchains, and top-tier operational automation.
• Solid Foundation, High Impact: Skip the initial heavy lifting. Centra has operated an ISO 27001-compliant ISMS for over three years, giving you a mature security base and strong organizational awareness to build upon.
• Direct Commercial Impact: As we accelerate into mid-market and enterprise segments, your governance directly enables closed-won deals and fuels global market expansion.
• Great Vibe & Ecosystem: Work alongside brilliant, collaborative peers across engineering and leadership in a modern, flexible environment.

What You’ll Do.

• ISMS Ownership & Audit Compliance: Own and continuously improve Centra’s ISO 27001-certified Information Security Management System, managing internal, external, customer, and certification audit processes.
• Product & Infrastructure Security Governance: Define and enforce practical security standards for the Centra Platform, cloud environments, and internal systems, partnering directly with the CTO and Engineering leadership on security architecture, vulnerability management, and penetration testing.
• Enterprise Sales Enablement & Vendor Risk: Lead prospective customer security evaluations, manage contractual security requirements to support upmarket growth, and oversee third-party vendor security reviews (including SaaS platforms and emerging AI tooling).
• Risk Management & Incident Response: Drive the end-to-end information security risk management lifecycle - identifying, treating, and monitoring threats - while coordinating incident response, root-cause investigations, and remediation.
• Access Control & IT Security Supervision: Oversee identity and access management (IAM), privileged access reviews, endpoint protection fleet management, and security configurations across core IT infrastructure (including Google Workspace and MDM).
• Security Metrics, Awareness & Executive Reporting: Establish security KPIs, lead organizational security awareness initiatives, and report risks, incident trends, and ISMS performance directly to executive leadership.

What We’re Looking For.

Essentials

• ISO 27001 Certification & Audit Expertise: Valid ISO 27001 Internal Auditor or Lead Auditor certification, with proven experience building, documenting, and independently auditing an ISMS.
• Executive Communication & Relationship Building: A track record of collaborating directly with C-suite executives, aligning security priorities across non-technical departments, and clearly communicating risk at a strategic level.
• Product Security Governance: Experience integrating security requirements into SaaS product lifecycles and product roadmaps, working closely with engineering leadership to drive execution.
• Pragmatic Risk Approach: Ability to evaluate the true operational effectiveness of controls beyond paper compliance, balancing security rigor with usability and business speed.
• AI Governance: Experience establishing governance, policies, and risk evaluation frameworks for AI tooling and integrations.

Nice-to-Haves

• Technical & Product Background: Hands-on experience in technical engineering or IT roles (e.g., former Software Engineer, DevOps, or Systems Administrator) and familiarity with Google Workspace administration.

Our Recruitment Process.

Introductory Interview: Meet our recruiter, discuss your experience and expectations. (Online, 30-45 min)

Technical Interview: Dive into technical discussions. (Online or on-site, 1 hour)

Ways of Working Interview: Explore your alignment with our values and meet the team. (Online or on-site, 1 hour)

Executive Interview: Final meeting with our CFOO (Online, 30 minutes)

We’re committed to fair, inclusive hiring and to building a team with diverse perspectives. If you need adjustments during the process, please let us know.

Recruiting scams are on the rise, remember that Centra employees will only contact you from @centra.com email addresses. We will never ask for money, fees, or banking information as part of the process. We do not conduct interviews or do outreach via messaging apps (WhatsApp, Telegram, Messenger etc.) If you're unsure about a communication, don't click any links and email jobs@centra.com.