IT Manager

About the role

Shopify is building a licensed Electronic Money Institution (EMI) in Luxembourg, supervised by the Commission de Surveillance du Secteur Financier (CSSF). As an IT Manager on our Trust team, you'll make sure the entity meets the requirements of the Digital Operational Resilience Act (DORA) and CSSF expectations for the management of ICT risk, and marry that with how Shopify manages these risks globally.

You'll work on a global security compliance team that already runs Shopify's control programs and have dual reporting to the local Authorised Manager.

Your job is to take that program and make it work for the Luxembourg entity: running the controls, producing the evidence, and making sure the local requirements are covered. You'll also be the main person responsible for ICT risk and digital operational resilience for the entity, working closely with its local leadership and with Shopify's global security, infrastructure, and compliance teams.

The program already exists, so you won't be starting from nothing. You'll run it, find the gaps, and keep improving it. We're looking for someone who can meet regulatory requirements in a way that fits how Shopify works, rather than changing how Shopify works to fit a checklist.

What you'll do

• Run the DORA and ICT risk program for the Luxembourg entity, adapting Shopify's global security program to local requirements

• Maintain the ICT risk register, policies, and leadership reporting current

• Manage incident classification and reporting so major ICT incidents reach the CSSF on time

• Oversee business continuity, disaster recovery, and resilience testing, including Threat-Led Penetration Testing (TLPT) where required

• Maintain the ICT third-party register, monitor critical providers against their service levels, and work with legal so contracts meet DORA requirements

• Document where entity data is stored and processed to meet regulatory requirements

• Run security controls and prepare evidence for audits and regulatory reviews, using automation and AI to cut manual work

• Help regulators understand how Shopify builds, operates, and uses AI

• Stay on top of changes to DORA and CSSF rules, and run annual security awareness training for the entity

What you'll bring

Experience in information security, IT risk, or technology compliance in a regulated financial services environment, such as a bank, payment institution, EMI, or insurer

• Hands-on knowledge of DORA, or of the areas it brings together: ICT outsourcing and third-party risk, IT business continuity and resilience, ICT incident management, and information security

• Working knowledge of at least one recognized security framework, such as ISO 27001, NIST CSF, or COBIT

• Experience running controls, collecting audit evidence, and working with auditors or regulators

• A practical approach to risk: you know how to meet a regulatory requirement in a way that fits a fast-moving tech company

• Comfort using AI tools to gather context and speed up your work, along with the judgment to check what they produce

• Clear written and verbal communication, including explaining technical risk to non-technical stakeholders and regulators

• Professional fluency in English

Nice to have

• Experience with both technology companies and financial services

• Familiarity with CSSF ICT circulars, such as CSSF 22/806 and 25/880

• Experience at a Luxembourg-regulated entity, or direct experience with CSSF supervisory processes

• Experience with cloud infrastructure (GCP, AWS, or Azure) and infrastructure as code in a regulated setting

• Certifications such as CISM, CISSP, CISA, or ISO 27001 Lead Implementer/Auditor

• Familiarity with Luxembourg data protection requirements for financial entities

Why this role

You'll be the person accountable for ICT risk for a newly licensed financial institution inside a global technology company. You'll see how a regulated entity runs from the start, work with a security team that treats automation and AI as everyday tools, and influence what modern, cloud-native compliance can look like.