Responsibilities
- Leading and managing a team of CISOaaS/GRC consultants to deliver high-quality services to clients
- Collaborating closely with clients to understand their business objectives, their risks and their unique security requirements
- Assessing the security maturity of clients (using of ISO, BSI or NIST standards) to identify gaps and areas for improvement
- Developing and implementing a fit-for-purpose security program (that aligns with industry standards)
- Driving the security program at clients, where you also act as the security champion, spreading the “gospel” on security
- Conducting risk assessments, identifying potential vulnerabilities, and recommending risk mitigation strategies
- Overseeing and supporting with the implementation of the security program, including policies, procedures, and controls
- Providing updates to management on the ‘state of security’ at their company
- Holding steering committees at the customer with relevant stakeholders to guide & adapt the security program, where needed
- Involve yourself actively in the sales process by creating and presenting Statements of Work, project plans, requirements definitions,… for projects running in your team
- Perform technical account management duties for specific top-tier, strategic clients
Requirements
- You are eligible for NATO Clearance
- Bachelor’s degree in Business Administration, Information Security, or a related field
- Proven experience in being a CISO and/or having successfully implemented ISO27k or BSI Grundschutz at clients. This covers, but not limited to: risk assessment, security roadmap creation, CISOaaS and policy development
- In-depth knowledge of relevant industry standards and frameworks, such as ISO 27001, DORA, NIST, NIS-2, GDPR, etc.
- Familiarity with risk management methodologies and their application to cybersecurity
- Excellent English and German written and verbal communication skills to effectively convey complex concepts to technical and non-technical stakeholders
- Leadership skills to manage a team and collaborate with clients and cross-functional teams
Nice to Have
- Professional certifications such as Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), ISO27001 Implementer/Auditor or equivalent
Benefits
- A training budget of 10,000 EUR plus 10 days paid time off rolling over two years
- Working with and learning from the best people in the European cyber security “scene”. We have several SANS Instructors working for us and we are also represented at popular hacking conferences (BlackHat, BruCON, OWASP, etc.). In addition, our employees can take advantage of prestigious continuing education opportunities (GSE, GXPN, CISSP, OSCP, etc.)
- A forward-thinking and agile company that supports you in the creation and implementation of new initiatives
- Unique team events (most recently e.g. Lisbon, Dubai, Malta, Lapland)
- A sophisticated coaching concept starting on day 1
- 30 days of vacation
- Flexible working hours and home office options (+ Working Abroad Option within the EU)
- Cost absorption for Deutschlandticket and the BahnCard50
- Company bike leasing
- Company pension scheme
- A cool office in the heart of Frankfurt and Munich (Roof terrace, table tennis, Playstation, BBQ)
Work Arrangement
Hybrid
Team
Structure: team of CISOaaS or GRC consultants
Additional Information
- Please be aware that the creation and submission of application documents (e.g. CV, cover letter, case studies, etc.) using AI-powered tools is only permitted to a limited extent. Our expectations: Application documents must authentically reflect your own qualifications, personality, and motivation. The use of AI for supportive purposes (e.g. spell-checking, improving wording) is acceptable. Fully generated application documents created by AI without personal adaptation or review are not permitted. Under no circumstances may NVISO information, data, or documents be uploaded to or processed by external AI tools. We reserve the right to exclude applications from the selection and interview process that are clearly created primarily or exclusively by AI and show no recognizable personal input. The purpose of this policy is to ensure a fair and transparent recruitment process and to obtain an authentic impression of our applicants.
