Company overview

BALFIN Group is one of the most successful investment groups in the Western Balkans. Established in 1993, the Group today operates across Austria, Albania, Kosovo, Bosnia and Herzegovina, Croatia, North Macedonia, Switzerland, Montenegro, the Netherlands, Canada, and the United States of America.

Its diversified portfolio spans multiple sectors, including banking, real estate development, wholesale and retail, asset management, tourism, logistics, education, and entertainment.

With a workforce of approximately 5,500 professionals, BALFIN Group continues to grow steadily, guided by strong business ethics, financial stability, innovation, and a long-term commitment to community impact through Mane Foundation.

Happy Pay Sha is BALFIN Group’s fintech platform, offering regulated digital financial services in Albania. Established in 2020, Happy has evolved beyond loyalty programs to offer integrated electronic payment processing, digital wallet services, Buy Now Pay Later (BNPL) credit solutions, and the issuance of electronic money. Serving both individuals and businesses, its mobile app and integrated POS/kiosk systems support, secure and flexible payment solutions - creating a full digital transaction ecosystem. Licensed under Albanian financial regulations, Happy Pay will uphold high standards of security, compliance, and user experience and lead Albania’s digital finance transformation with innovation and smart commerce solutions.

Company: Happy Pay sha

Overview:

The Information Security Officer is responsible for establishing, implementing, maintaining, and continuously improving the information security framework of the company. The role ensures the confidentiality, integrity, and availability of information assets, systems, applications, and customer data while supporting compliance with regulatory requirements, cybersecurity standards, and internal policies.

The Information Security Officer acts as the second line of defense, providing independent oversight of information security risks, cybersecurity controls, ICT security measures, and security governance across the institution.

Key Responsibilities

• Develop, implement, and continuously improve the Information Security Framework, including policies, procedures, standards, and security strategy aligned with business objectives, risk appetite, and regulatory requirements.
• Lead the institution's information security governance by promoting a security-aware culture and providing regular reporting on cybersecurity posture, security risks, incidents, and key initiatives to Senior Management, Committees, and the Board.
• Identify, assess, monitor, and mitigate information security and cyber risks through risk assessments, maintenance of the Information Security Risk Register, monitoring of emerging threats, and implementation of appropriate security controls.
• Oversee the effectiveness of cybersecurity controls across networks, applications, cloud environments, databases, endpoints, and digital channels, including identity and access management, privileged access, segregation of duties, user permissions, vulnerability management, penetration testing, and remediation activities.
• Coordinate the Cyber Security Incident Response process, ensuring incidents are detected, investigated, documented, escalated, resolved, and reported, while monitoring corrective actions and fulfilling regulatory reporting obligations.
• Support Business Continuity Management (BCM), Disaster Recovery (DR), backup and recovery processes, and participate in continuity planning and testing to strengthen operational resilience.
• Assess and monitor information security risks related to vendors, outsourcing arrangements, third parties, new technologies, projects, and ICT changes by applying security-by-design and privacy-by-design principles.
• Develop and deliver security awareness and training programs covering cybersecurity, phishing, social engineering, data protection, and emerging security threats.
• Ensure compliance with applicable ICT, cybersecurity, information security, operational resilience, and data protection regulations, while maintaining alignment with relevant regulatory requirements and industry-recognized security frameworks and standards.
• Ensuring that all IT and information security programs are in compliance with applicable laws, regulation and polices.
• Monitors the compliance with Data Protection Laws and Regulations and is part of the team established for this purpose;

Job Requirements

• Master’s degree in information technology, Computer Science, Cybersecurity, Information Systems, or a related field.
• At least 3 years solid experience working in IT/ IT Audit and/or Information Security.
• As a professional, to fit the profile of a strong organizer and influencer.
• Highly proficient in English language.
• Excellent knowledge in IP protocol and network security technologies;
• Strong adaptability and curiosity in new technological practices or new solutions
• Personality described as both driven and structured and analytical mind.
• Excellent relationship management and networking skills.
• Sensitive to organizational needs and interests to a high degree.
• Professional certification is preferred (such as CISSP, CISM, CISA or other information security credentials).
• Knowledge of information security and control frameworks such as ISO 27001, ISO 27002, ISO 27005, COBiT, COSO and ITIL.

What We Offer

· An attractive benefit package, including fair remuneration based on merit and performance evaluation.

· An exceptional opportunity to develop your skills and growth within BALFIN Group.

· Extra Leave days

· Dynamic and collaborative work environment

Your personal data (in your capacity as a job candidate) will be processed in accordance with Law no. 124/2024, dated 19/12/2024 "On the Protection of Personal Data," as well as the Internal Regulation on the Protection of Personal Data (approved by Happy Pay Sha). This applies to the confidentiality and security of personal data. Only selected applicants will be notified about the next stages.

The processed data is accessed solely by HAPPY Pay Sha as the employer, specifically by the Human Resources Department.

The data of unsuccessful candidates will be retained for a maximum period of 1 year from the announcement of the successful candidate, for the purpose of contacting them in case of similar job openings matching the applicant’s profile. After 1 year, the data will be irreversibly deleted.