Tasks
- Operate and advance our ISMS across core components: Scope, Control Catalog, Statement of Applicability, and Management Review.
- Manage the end-to-end risk lifecycle from identification and evaluation to treatment decisions, maintaining the central risk register with assigned ownership.
- Oversee the full policy lifecycle including drafting, reviewing, approving, communicating, and managing formal exception workflows.
- Plan and accompany internal and external audits, coordinating evidence collection, sampling reviews, and corrective action tracking.
- Contribute to our certification roadmap and prepare its expansion into further international target markets.
- Establish structured audit readiness routines across software development, IT operations, and corporate units.
- Act as the primary interface to Privacy, Legal, regulatory bodies, and incident response teams, managing regulatory notification obligations.
- Serve as a trusted advisor for internal teams, business leaders, and external auditors regarding security controls and compliance posture.
Qualifications
- You combine strong risk methodology with an understanding of operational reality and articulate communication.
- Multiple years of practical experience with standardized information security management systems and cybersecurity attestations.
- Proven audit and compliance experience in at least two certified domains (e.g., ISO/IEC 27001, BSI IT-Grundschutz, BSI C5, or PCI DSS).
- Proficient risk management methodology and the ability to translate technical concepts into sound business risk statements.
- Demonstrated composure and competence in facilitating external audit engagements and liaising with assessors.
- High editorial precision with the ability to draft clear, concise, and enforceable corporate policies.
- Experience partnering with technical engineering and cloud operations teams without imposing administrative bottlenecks.
- Strong facilitation and stakeholder management skills up to executive leadership.
- Business fluency in German (C2 level) and English (minimum C1 level) in both written and spoken communication.
- Nice to have:
- Familiarity with privacy information management frameworks (e.g., ISO 27701).
- Knowledge of European regulatory standards such as GDPR, NIS-2, or DORA.
- Experience with cross-framework control mapping and modern GRC automation tooling.
Note:
At the end of the application process, candidates must undergo a security check. Your consent will be requested in good time during the process.
Benefits
- Hybrid working model.
- Flexible working hours through trust-based working hours.
- At some locations a subsidized canteen and various free drinks.
- Modern office space with very good transport connections.
- Various employee discounts for activities and products.
- Employee events such as summer and winter parties, as well as workshops.
- Numerous training and development opportunities.
- Various health offers, such as sports and health courses.
#J-18808-Ljbffr