Senior ICT Security Analyst

Company Description

Finance Incorporated Limited was established in 2012 and licensed as a financial institution to carry out payment services. During past years, the company created different products under different brands. As a financial institution, the concept behind Finance Incorporated is to bring together various services from separate disciplines to create a financial gateway, where the clients could reach many services with one click.

Finance Incorporated is being managed by a diverse Board of Directors and executives where new ideas are fused with robust governance and controls, valuing strict oversight and transparency whilst never ceasing to innovate and develop.

Our Team, Our Company, Our Home is the motto of Finance Incorporated Limited. We value and support each other in every way we can.

Key Responsibilities

• Own FIL’s core security processes, including incident management, vulnerability and patch management, access reviews, third-party security assessments, security awareness, and security policies.
• Ensure compliance with DORA, PCI-DSS, ISO 27001, GDPR, PSD2, SWIFT and MFSA requirements.
• Monitor SIEM, XDR and cloud security tools; investigate incidents, manage malware and phishing investigations, classify incidents under DORA, and support regulatory reporting and BCP/DR exercises.
• Coordinate vulnerability assessments, patching, remediation, penetration testing, system and vendor security reviews, and privileged access reviews.
• Maintain the ISMS, ICT risk framework, risk registers, procedures, RACIs, KPIs/KRIs and audit-ready evidence, ensuring continuous improvement.
• Conduct supplier security assessments, review SOC 2 and ISO 27001 reports, maintain DORA Register of Information inputs, and monitor critical ICT providers.
• Coordinate audits and remediation, monitor regulatory changes, and prepare management and Board security reports.
• Deliver security awareness campaigns, phishing simulations and targeted training, collaborating with IT, Compliance, Risk and Legal to promote a strong security culture.

Requirements

• Bachelor’s degree in Computing, Cybersecurity, Information Systems or a related field, or equivalent professional experience.
• At least five years in information security, including two years in hands-on security operations, incident response or vulnerability management.
• Practical experience with SIEM/XDR platforms, detection rules, vulnerability scanners (e.g. Nessus or Qualys), and penetration testing.
• Strong knowledge of network security, identity and access management, encryption, authentication, and at least one major cloud platform (Azure, AWS or GCP).
• Working knowledge of ISO 27001, PCI-DSS, ICT risk assessment, DORA and GDPR, with the ability to translate regulatory requirements into controls and evidence.
• Strong written English and eligibility to work in Malta.

Qualifications

• Relevant certifications such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer/Auditor, GIAC, CEH or CompTIA Security+/CySA+.
• Experience in an EMI, payment institution, bank, CASP or other MFSA-regulated firm.
  
• Experience in PCI-DSS assessments, DORA implementation or ICT third-party risk management.
  
• Scripting skills in Python or PowerShell, and exposure to container/Kubernetes security, cloud security posture management or secure SDLC practices.