Information Security Manager

While we welcome applications from everywhere, please note that at this stage we are prioritizing candidates who are already based in Stockholm and eligible to work in Sweden without visa sponsorship.

_______________________________

We are Bambuser, and we are reshaping commerce

Video has quickly become one of the most powerful ways for brands to engage, inspire, and convert consumers.

At Bambuser, we’re helping some of the world’s most recognized brands transform how they sell online through live shopping, shoppable video, and interactive commerce experiences. Brands including L’Oréal, Audi, Sephora, and Sonos use our platform to create richer and more engaging customer experiences.

As a global B2B SaaS company working with enterprise customers, trust matters at every stage of our business. Customers need to know that their data is handled responsibly. Teams need clear and practical guidance. Auditors need evidence that our controls work. As technology and regulation evolve, particularly around AI, our security practices need to keep pace.

That’s where you come in.

_______________________________

About the role

Bambuser already has strong security foundations, including an ISO 27001-certified information security management system (ISMS). Your challenge will be to build on them as our business, customer expectations, and the regulatory landscape continue to evolve.

You’ll own our ISMS, including the information security Risk and Asset Registers, and partner with our General Counsel on the security side of privacy compliance. Day to day, you’ll help the business meet its regulatory obligations, keep our policies practical and current, and make sure we stay audit-ready year-round. Compliance and audit readiness are outcomes of doing security right, not ends in themselves.

We’re a fast-moving scale-up, so we need you to think the way we all try to think: what can be automated, templated, or scheduled instead of done by hand again? If you find yourself doing the same manual task twice, build the system that makes sure nobody has to do it a third time. The goal is to cut busywork, yours and everyone else’s, so time goes to the work that truly needs a human.

You’ll be part of our Operations team, reporting to the VP Operations and working closely with Legal, Engineering, IT Ops, and our commercial teams.

_______________________________

Main duties and responsibilities

• ISMS Governance & Audit Readiness: Own the ISO 27001 certification lifecycle and annual ISMS calendar, keeping recurring activities on track, from training and management reviews to nonconformities and corrective actions. Maintain the information security Risk and Asset Registers, keeping risks connected to business priorities. Run internal and external audits end to end: scoping, evidence collection, stakeholder coordination, and remediation.
• Keeping policies sharp: Own the full ISMS library and right-size policies to our actual risk profile. Build policies, playbooks, and control documentation that hold up under scrutiny and work in practice. Drive adoption through clear communication and practical guidance, so policies become part of how people work.
• The face of security to customers & vendors: Be the go-to contact for enterprise customer security reviews, RFP security sections, and the Trust Center. Lead the rollout of our RFP AI tool. On the procurement side, review new tools and vendors, including AI tools, for data handling, access, and integration risk before adoption.
• Regulation, Privacy and AI: Partner with Legal to track regulation across our markets and translate relevant requirements into concrete security controls with clear internal ownership. Support the security side of privacy compliance, including vendor data handling reviews and inputs to the Record of Processing Activities (ROPA) and Data Protection Impact Assessments (DPIAs). Assess security risks associated with AI tools and help keep our AI usage guidelines current.
• Security testing and training: Coordinate penetration testing engagements with vendors and Engineering, from scoping and arranging access to tracking findings through remediation. Own our security awareness training program and content, designing and delivering onboarding and recurring sessions that stay relevant as threats and regulations shift.
• Automation and ownership: Turn security workflows into documented, automated processes. Work with IT Ops and other teams on evidence collection, control monitoring, training reminders, audit scheduling, and recurring tasks. Help teams understand and own their part in keeping Bambuser secure.

_______________________________

Requirements

• Experience: 5+ years in information security compliance, IT audit, or risk management, ideally in B2B Saa