Information Security Manager (m/w/d) · Cloud

Tasks

• Operate and advance our ISMS across core components: Scope, Control Catalog, Statement of Applicability, and Management Review.
• Manage the end-to-end risk lifecycle from identification and evaluation to treatment decisions, maintaining the central risk register with assigned ownership.
• Oversee the full policy lifecycle including drafting, reviewing, approving, communicating, and managing formal exception workflows.
• Plan and accompany internal and external audits, coordinating evidence collection, sampling reviews, and corrective action tracking.
• Contribute to our certification roadmap and prepare its expansion into further international target markets.
• Establish structured audit readiness routines across software development, IT operations, and corporate units.
• Act as the primary interface to Privacy, Legal, regulatory bodies, and incident response teams, managing regulatory notification obligations.
• Serve as a trusted advisor for internal teams, business leaders, and external auditors regarding security controls and compliance posture.

Qualifications

• You combine strong risk methodology with an understanding of operational reality and articulate communication.
• Multiple years of practical experience with standardized information security management systems and cybersecurity attestations.
• Proven audit and compliance experience in at least two certified domains (e.g., ISO/IEC 27001, BSI IT-Grundschutz, BSI C5, or PCI DSS).
• Proficient risk management methodology and the ability to translate technical concepts into sound business risk statements.
• Demonstrated composure and competence in facilitating external audit engagements and liaising with assessors.
• High editorial precision with the ability to draft clear, concise, and enforceable corporate policies.
• Experience partnering with technical engineering and cloud operations teams without imposing administrative bottlenecks.
• Strong facilitation and stakeholder management skills up to executive leadership.
• Business fluency in German (C2 level) and English (minimum C1 level) in both written and spoken communication.
• Nice to have:
• Familiarity with privacy information management frameworks (e.g., ISO 27701).
• Knowledge of European regulatory standards such as GDPR, NIS-2, or DORA.
• Experience with cross-framework control mapping and modern GRC automation tooling.

Note:

At the end of the application process, candidates must undergo a security check. Your consent will be requested in good time during the process.

Benefits

• Hybrid working model.
• Flexible working hours through trust-based working hours.
• At some locations a subsidized canteen and various free drinks.
• Modern office space with very good transport connections.
• Various employee discounts for activities and products.
• Employee events such as summer and winter parties, as well as workshops.
• Numerous training and development opportunities.
• Various health offers, such as sports and health courses.