Group Information Security Manager

Kurz zusammengefasst

Orcrist develops a next‑generation data intelligence platform that processes petabyte‑scale information with sub‑second response times. The solution runs on Kubernetes and is offered both as a B2B SaaS service and as a self‑hosted, air‑gapped product for defence, law‑enforcement and enterprise customers. The Group Information Security Manager will lead the security strategy and programme for the Vektor Group, partnering closely with the Director of Internal IT to implement technical controls and ensure compliance. The day‑to‑day work involves building and operating a group‑wide ISMS based on BSI standards, creating and maintaining security policies, and preparing for ISO 27001 certification while conducting internal audits. The role also covers NIS‑2 compliance, risk management across technical and organisational areas, steering external consultants, running security awareness training, and coordinating incident response together with IT, legal and leadership. Additional duties include assessing third‑party risk, supporting sales with security questionnaires, and monitoring emerging regulations such as the EU AI Act. Candidates must have several years of experience in an information‑security leadership position or a comparable role, demonstrable expertise with BSI IT‑Grundschutz standards and the Grundschutz‑Kompendium, and a track record of establishing ISO 27001 programmes from gap analysis through audit readiness. Strong risk‑management skills, a hands‑on attitude during the build‑up phase, and confidence in interacting with executives, auditors and customers are required. Language proficiency must be German at C1 level or higher and English at B2 level or above. Preferred qualifications include certifications such as IT‑Grundschutz‑Praktiker/‑Berater, ISO 27001 Lead Implementer or Lead Auditor, CISSP or CISM, as well as experience governing security across multiple legal entities. Background in regulated sectors like defence, government or critical infrastructure, familiarity with standards such as VS‑NfD, Geheimschutz or AQAP, practical NIS‑2 implementation, and involvement in sales‑adjacent security activities are considered advantageous. The position is remote‑first across Germany, offers flexible hours, a home‑office budget, 30 days of vacation, performance bonuses, and a mission focused on public safety and national security. What the role asks for: - Several years of ISB or comparable information‑security experience - Proven practice with BSI IT‑Grundschutz standards 200‑x - Experience building ISO 27001 programmes end‑to‑end - Solid risk‑management and communication skills - Willingness to work hands‑on during build‑up phase - Confident interaction with executives, auditors and customers - German language at C1 level or higher - English language at B2 level or higher - Certifications: IT‑Grundschutz‑Praktiker/‑Berater, ISO 27001 Lead Implementer or Lead Auditor, CISSP, CISM (nice‑to‑have) - Security governance across multiple legal entities or jurisdictions (nice‑to‑have) - Experience in regulated environments: defence, government, critical infrastructure (nice‑to‑have) - Practical NIS‑2 implementation experience (nice‑to‑have) - Experience with sales‑adjacent security processes (nice‑to‑have)