CISO

Project overview

JOB DESCRIPTION AND RESPONSIBILITIES DOCUMENT

Information Security and Data Protection

Officer

Chief Information Security Officer / Data Protection Officer (CISO / DPO)

This document defines the duties, authority, and responsibilities of the Information Security and

Data Protection Officer position within a Virtual Asset Service Provider (VASP) subject to VARA

regulations. The document is general in nature and does not contain information relating to any

specific company, product, individual, or internal policy. Regulatory references are made to the

VARA Rulebooks in force as of the date of reference.

Position Information Security and Data Protection Officer (CISO / DPO)

Function Control function responsible for information security, cybersecurity, and

personal data protection

Reporting Direct access to the Board of Directors; participation in the relevant Board

committee

Working Model Full-time employee or outsourced arrangement in accordance with VARA’s

outsourcing provisions

Regulatory Status Member of Senior Management; subject to VARA Fit & Proper assessment

Independence Requirement Cannot be the same individual as the Compliance Officer

The CISO / DPO is an independent control function responsible for technology governance,

information security, cybersecurity, wallet and cryptographic key security, smart contract security,

protection of confidential information, and personal data protection.

The purpose of the role is to protect the integrity, confidentiality, and availability of the company’s

systems, customer platform, wallet infrastructure, cryptographic keys, smart contracts, personal

data, and confidential business information; identify and mitigate technology and cyber risks; ensure

timely response to incidents; and ensure that required notifications are made to the regulator.

Compliance Officer role in the same individual (Technology and Information Rulebook I.I.1).

any conflicts of interest.

personal data processing. This is intended to preserve independence from a data protection

perspective.

the duties and must be subject to the company’s governance, reporting, and incident management

framework.

4.1 Event-Based and Immediate Actions

smart contract exploitation – detection, classification, containment, root cause analysis, and

implementation of corrective actions.

VARA within no later than 72 hours (Technology and Information Rulebook I.K.1).

than 24 hours after notification is made to the data protection authority or affected individual.

procedure, disabling affected keys, and re-keying.

written approval before returning it to a clean operational state.

wallet infrastructure, or service provider.

processing activity.

legally required timeframe after identity verification.

the next periodic reporting cycle.

4.2 Ongoing Activities

endpoint systems, cloud environments, and wallet infrastructure.

segregation-of-duties principles.

privacy, security, and data processing questions.

4.3 Periodic Activities

Monthly

Quarterly

significant incidents, outstanding findings, wallet/key/smart contract risks, third-party risks, and

business continuity preparedness.

cybersecurity policy, and data protection compliance program.

(Technology and Information Rulebook I.E.1).

Information Rulebook I.H.1).

III.G.1).

4.4 Cryptographic Key, Wallet, and Smart Contract Security

Board approval.

including multi-signature mechanisms and approval thresholds.

all approval groups; and reconcile the access register against personnel records.

mint/burn keys, pause keys, upgrade keys, key ownership, storage methods, and approval

thresholds.

authorization governance remains within the company and is subject to independent security

review.

4.5 Personal Data Protection

the data inventory and records of processing activities.

data transfers.

systems, records, personnel, and service providers.

the Board without obtaining prior approval.

the role holder considers the allocated resources insufficient, this must be reported to the Board.

information systems, law, data protection, or a related field.

protection. Experience in a regulated financial institution, fintech company, or VASP environment is

preferred.

continuity, and third-party risk management.

processes.

cryptographic keys.

screening and regulatory suitability assessments.

ISO/IEC 27701, CIPP/E, CIPM, CIPT, CDPO, and blockchain or smart contract security certifications.

Note: VARA regulations do not prescribe a specific minimum number of years of experience for this

role. Any experience threshold is determined by the employer.

The role holder must disclose:

• Position Profile
• Purpose and Scope of the Role
• Regulatory Position and Independence
• The CISO function is mandatory under VARA regulations and may not be combined with the
• The role holder must possess sufficient capacity, experience, and independence and must not have
• The role holder may not undertake operational duties that determine the purposes and means of
• Where the position is outsourced, the appointed individual must accept personal responsibility for
• Duties and Responsibilities
• Cybersecurity incident – including phishing, malware, unauthorized access, wallet anomalies, or
• Material cybersecurity incident or event triggering the business continuity plan – notification to
• Personal data breach – assessment of scope and impact; support for notification to VARA no later
• Loss or compromise of a wallet or cryptographic key – activation of the emergency response
• In the event of suspected exploitation or key compromise, pausing the smart contract and requiring
• Security and privacy due diligence before introducing a new system, product, blockchain network,
• Conducting a Data Protection Impact Assessment (DPIA) before commencing any new high-risk data
• Handling data subject requests – including access, rectification, erasure, and objection – within the
• Reporting any significant finding or risk to Senior Management and the Board without waiting for
• Reviewing and prioritizing alerts received from security monitoring infrastructure, including SIEM,
• Evaluating privileged access requests in accordance with the authorization matrix and
• Verifying security controls for critical wallet transfers and smart contract administrative operations.
• Tracking open security findings and corrective actions.
• Coordinating with technology, compliance, legal, and operational functions and responding to
• Review open vulnerability and penetration testing findings.
• Sample privileged access lists and wallet transaction approval records.
• Test backup and restoration controls.
• Assess third-party security and privacy findings.
• Present a summary of Key Risk Indicators (KRIs) and control effectiveness to Senior Management.
• Present a report to the Board or relevant committee covering the technology and cyber risk profile,
• Update the technology and cybersecurity risk register.
• Re-certify privileged access.
• Update the personal data inventory and data flow map.
• Conduct a tabletop exercise or thematic security test.
• Perform a comprehensive review of the technology governance and risk assessment framework,
• Coordinate penetration testing, vulnerability assessments, and independent smart contract audits
• Conduct business continuity and disaster recovery testing and update the plan (Technology and
• Renew due diligence for critical service providers.
• Conduct mandatory information security and data protection training.
• Complete the role holder’s own suitability and conflict-of-interest assessment (Company Rulebook
• Present the annual technology, security, and data protection assessment report to the Board
• Prepare and maintain the cryptographic key and wallet management policy and submit changes for
• Design and oversee processes for key generation, storage, backup, recovery, and destruction,
• Periodically audit wallet access privileges; verify that departing personnel have been removed from
• Define and audit post-deployment governance of smart contracts, including administrator keys,
• Even where smart contract development is outsourced, ensure that post-deployment key and
• Establish and maintain the personal data protection compliance program, including maintenance of
• Conduct Data Protection Impact Assessments (DPIAs) and oversee the legal basis for cross-border
• Operate processes relating to data subject rights and monitor data retention periods.
• Verify that contracts with data processors contain appropriate data protection provisions.
• Authority and Independence
• Performs duties using independent professional judgment and has the right to access all relevant
• Has direct access to Senior Management and the Board and may report significant risks directly to
• May request the suspension of any system, transaction, or release that carries unacceptable risk.
• Must promptly disclose any actual or potential conflicts of interest.
• Must be provided with sufficient budget, resources, and personnel to perform the role effectively. If
• Required Qualifications
• Bachelor’s degree in information security, cybersecurity, computer or software engineering,
• Strong professional experience in cybersecurity, information security, technology risk, or data
• Practical knowledge of cybersecurity governance, risk assessment, incident response, business
• Experience in privacy compliance, DPIAs, data subject rights, and cross-border data transfer
• Technical understanding of risks related to blockchain, DLT, smart contracts, wallets, and
• Knowledge of applicable personal data protection legislation.
• Ability to report effectively at Senior Management and Board level; advanced English proficiency.
• High ethical standards and professional reputation; ability to successfully complete background
• Preferred certifications: CISSP, CISM, CRISC, CCSP, ISO/IEC 27001 Lead Implementer or Auditor,
• Conflicts of Interest
• Simultaneous employment or appointment at another Virtual Asset Service Provider or regu

Project details

• Start: flexible
• Location: GB
• Languages: English