Information Security Officer
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Information Security Officer leading Vektor Group’s BSI-based ISMS, ISO 27001 certification, and NIS-2 compliance. Securing AI platforms built for defence and government customers.
Responsibilities:
- Own the Vektor Group's information security strategy, programme, and posture from strategy through hands-on execution
- Build and operate the group-wide ISMS following BSI standards 200-1/200-2/200-3, including structure analysis, protection needs assessment, modelling, and risk analysis
- Create and maintain the group-level security policy framework and processes, coordinating company-specific additions
- Prepare and accompany ISO 27001 certification, conduct internal audits, and work with external auditors
- Implement NIS-2 obligations, including reporting processes, evidence management, and corrective action tracking
- Manage technical and organizational risk and report to executive management
- Steer external consultants and service providers within the security programme
- Build and run security awareness training and sensitization programmes
- Own incident response planning and coordinate incidents with IT, Legal, and leadership
- Assess third-party and vendor risk and conduct security assessments for new tools and partners
- Collaborate with the Director of Internal IT on access governance, endpoint security, and identity, and with platform engineering on product security
- Support sales and customer trust processes, including security questionnaires, due diligence, and customer audits
- Track regulatory requirements such as the EU AI Act and Cyber Resilience Act and derive required actions
Requirements:
- Several years of experience as an ISB or in comparable responsibility for information security
- Proven practice with BSI IT-Grundschutz: BSI standards 200-x and the Grundschutz-Kompendium, ideally including a completed certification procedure
- Experience building or leading ISO 27001 programmes, from gap analysis to audit readiness
- Solid risk management: assess, prioritize, and communicate risk clearly to technical and non-technical audiences
- Willingness to work hands-on during the build-up phase
- Confident interaction with executive management, auditors, and customers
- German at C1 or above
- English at B2 or above
- Nice to have: IT-Grundschutz-Praktiker/-Berater, ISO 27001 Lead Implementer or Lead Auditor, CISSP, or CISM certifications
- Nice to have: experience with security governance across multiple legal entities or jurisdictions
- Nice to have: experience in regulated environments such as defence, government, or critical infrastructure; familiarity with VS-NfD, Geheimschutz, or AQAP
- Nice to have: practical NIS-2 implementation experience
- Nice to have: experience with sales-adjacent security processes, pre-sales, and customer audits
Benefits:
- International team with colleagues across Germany and other locations
- Startup environment with real ownership, flat hierarchies, and fast decisions
- Competitive compensation aligned with experience and responsibility
- Individual learning and growth opportunities beyond your role
Similar Jobs
IT Security Architect – IAM, On-Premises
IT Security Architect defining IAM, Active Directory, Entra ID, and on-prem security standards. Advising technical teams at sports nutrition company The Quality Group.
IT Security Architect – IAM, On-Premises
IT-Security-Architekt für IAM, Active Directory und On-Prem-Infrastruktur bei Sporternährungsanbieter The Quality Group. Entwicklung von Sicherheitsstandards und Beratung technischer Teams.
Cybersecurity Consultant
Consultant cybersécurité chez Wavestone, cabinet international accompagnant les transformations stratégiques. Intervention sur gouvernance, cloud, audits, risques et sécurité des systèmes.
Founding Information Security Lead
Founding Information Security Lead owning security, compliance, and IT operations for Flodesk’s email marketing platform. Building SOC 2, ISO 27001, and CCPA readiness.
Cybersecurity Architect
Cybersecurity Architect leading RMF, risk mitigation, and ATO efforts for DoD Zero Trust systems. GDIT delivers technology and mission services to U.S. government, defense, and intelligence agencies.
Senior Security Agent / AI Red Team Engineer
AI red-team engineer attacking PGTEK agents and converting findings into durable controls. Supporting secure Federal and DoD systems through threat modeling, remediation, and authorization activities.
Software Security Lead
Software Security Lead securing Cisco’s enterprise IT and Operations platforms across applications, cloud, identity, data, and AI. Leading threat modeling, architecture reviews, risk remediation, and security metrics.
Staff Security Researcher
Staff Security Researcher conducting vulnerability research and penetration testing for GitLab’s AI-powered DevSecOps platform. Developing attack methodologies, tooling, and security improvements.
Software Security Lead
Cisco software security lead securing AI-enabled enterprise platforms and applications. Leading threat modeling, architecture reviews, risk remediation, and portfolio security metrics.
Principal Security Researcher
Principal Security Researcher securing GitLab’s AI-powered DevSecOps platform. Leading vulnerability research, AI attack analysis, penetration testing, and remediation across GitLab’s codebase.
Application Security Remediation Engineer
Application Security Remediation Engineer remediating Wiz findings across enterprise applications for Arctiq’s technology services clients. Securing code, dependencies, containers, and DevSecOps delivery pipelines.
Senior Engineer, Information Security Architect
Information Security Architect engineering secure platforms and enterprise designs for Lovesac, a fast-growing adaptable furniture company. Leading Zero Trust architecture, security tooling, integrations, and governance.
Senior Security Engineer – Identity and Access Management
Senior IAM Security Engineer designing automated identity controls for Providence, a comprehensive healthcare organization. Modernizing hybrid identity infrastructure toward Zero Trust and cloud security.
Cybersecurity Engineer
Cybersecurity Engineer managing endpoint, identity, cloud, and enterprise security for Accela’s cloud-based government software platform. Supporting vulnerability management, compliance controls, investigations, and security automation.
Cyber Security Engineer
Cyber Security Engineer securing Emprise Bank through vulnerability management, identity access, DLP, vendor reviews, and incident response. Providing tier 3 security support and leading IT Security projects.
VP of IT and Cybersecurity
VP leading IT and cybersecurity strategy, reliability, and risk for Tidal Financial Group’s ETF investment technology platform. Advising executives and managing teams, vendors, incidents, and compliance.
IT Security Specialist
IT Security Specialist protecting Fika’s rural infrastructure nonprofit systems from cyber threats. Securing networks, cloud environments, endpoints, and compliance operations across global program offices.
Senior Digital Forensics and Incident Response Engineer
Senior DFIR Engineer leading identity-theft investigations and automation for Humana, a U.S. healthcare and insurance company. Supporting enterprise cyber investigations, incident response, and forensic capability development.
Senior Offensive Security Engineer
Senior offensive security engineer testing First Advantage’s products, cloud infrastructure, networks, and people. Building adversary simulations and driving remediation to reduce enterprise risk.
Security Engineer
Security Engineer securing PIP Labs’ DATA Network infrastructure, cloud environment, endpoints, and internal systems. Automating security operations and protecting sensitive real-world data used for AI training.