Orcrist Technologies - Group Information Security Manager

• Build and operate the group-wide ISMS following BSI standards 200-1/200-2/200-3: structure analysis, protection needs assessment, modelling, risk analysis • Create and maintain the security policy framework and processes at group level; coordinate company-specific additions • Prepare and accompany ISO 27001 certification, run internal audits, work with external auditors • Implement NIS-2 obligations: reporting processes, evidence management, corrective action tracking • Manage risk across technical and organizational domains, including reporting to executive management • Steer external consultants and service providers within the running programme • Build and run the security awareness programme: training and sensitization • Own incident response planning and coordinate during incidents, together with IT, Legal, and leadership • Assess third-party and vendor risk, run security assessments for new tools and partners • Work closely with the Director of Internal IT (technical controls: access governance, endpoint security, identity) and with platform engineering (interface to product security) • Support sales and customer trust processes: security questionnaires, due diligence, customer audits • Track further regulatory requirements (EU AI Act, Cyber Resilience Act, among others) and derive required action • Several years of experience as an ISB or in comparable responsibility for information security • Proven practice with BSI IT-Grundschutz: BSI standards 200-x and the Grundschutz-Kompendium, ideally including a completed certification procedure • Experience building or leading ISO 27001 programmes, from gap analysis to audit readiness • Solid risk management: you assess, prioritize, and communicate risk clearly to technical and non-technical audiences • Willingness to work hands-on during the build-up phase • Confident interaction with executive management, auditors, and customers • German at C1 or above, English at B2 or above • Nice-to-haves • Nice-to-haves • Certifications: IT-Grundschutz-Praktiker/-Berater, ISO 27001 Lead Implementer or Lead Auditor, CISSP, CISM • Experience with security governance across multiple legal entities or jurisdictions • Experience in regulated environments: defence, government, critical infrastructure; familiarity with VS-NfD, Geheimschutz, or AQAP • Practical NIS-2 implementation experience • Experience with sales-adjacent security processes (pre-sales, customer audits)