AI & SDLC Risk Manager (f/m/d)

Deutsche Börse Group; Frankfurt; On-site; EUR 95,000 - 130,000; Full time

Job summary

Deutsche Börse Group is seeking an AI & SDLC Risk Manager to join Group ICT Risk in Frankfurt. You will assess the security of AI systems and software development pipelines, translating your engineering background into risk insights that protect critical market infrastructure, working closely with the Group CISO and first-line engineering teams.

In this second-line role, you will drive resilience strategies, evaluate SSDLC maturity, and support regulatory audits (DORA, EU AI Act) while

Qualifications

• 2+ years of professional experience in product delivery, DevOps, or related engineering field.
• Hands-on security tooling experience (SAST/DAST, SBOM) and cloud security knowledge.
• Ability to read code and understand CI/CD pipelines; hands-on engineering background.
• Experience communicating findings to both technical and non-technical audiences.
• Familiarity with SCRUM/Kanban or OKRs.

Responsibilities

• Drive resilience strategy: Shift Left, Shift Down, Shield Right in collaboration with the Head of ICT Risk.
• Assess AI and Cloud systems for AI-specific risks and prepare management content for boards.
• Evaluate SSDLC maturity against IEC 62443-4-1 and CRA; challenge CI/CD security controls.
• Support the SQUARE initiative (Post-Quantum Cryptography) with technical assessments and migration readiness.
• Conduct DORA-compliant application risk assessments and manage observation tracking with first-line teams.
• Support internal and regulatory audits (DORA, BaFin) and EU AI Act implementation as a second-line function.

Skills

Software engineering background

CI/CD understanding

Agile / SCRUM / Kanban

Communication to technical and non-技术

English proficiency

German language (asset)

Tools

SAST

DAST

SBOM

Container security

Terraform

Job description

Your area of work:

Group ICT Risk acts as the second line of defence for one of the world’s leading financial market infrastructures, overseeing ICT risks across Deutsche Börse Group. As an AI & SDLC Risk Manager, you will assess and challenge the security of AI systems and software development pipelines, translating your engineering background into risk-relevant insights that protect critical market infrastructure. You will be part of a newly built unit operating at the intersection of technology, regulation, and capital markets, working closely with the Group CISO and first-line engineering teams.

Your career at Deutsche Börse Group

Group ICT Risk acts as the second line of defence for one of the world’s leading financial market infrastructures, overseeing ICT risks across Deutsche Börse Group. As an AI & SDLC Risk Manager, you will assess and challenge the security of AI systems and software development pipelines, translating your engineering background into risk-relevant insights that protect critical market infrastructure. You will be part of a newly built unit operating at the intersection of technology, regulation, and capital markets, working closely with the Group CISO and first-line engineering teams.

Your responsibilities:

• You drive the resilience strategy operationally, Shift Left (security embedded in development), Shift Down (platform security, OSCAL, infrastructure-as-code, Terraform), Shield Right (vulnerability management, patching, 1D1D), in close collaboration with the Head of ICT Risk
• You assess AI and Cloud systems, deployed in trading, clearing, and risk environments for AI-specific risks such as adversarial ML, prompt injection, data poisoning, and uncontrolled agent behaviour, and prepare content for management and supervisory bodies
• You evaluate the maturity of the Secure Software Development Lifecycle (SSDLC) e.g. against IEC 62443-4-1 and the Cyber Resilience Act, and challenge security controls in CI/CD pipelines (SAST, DAST, SCA, container scanning) from an independent second-line perspective
• You support the SQUARE initiative (Post-Quantum Cryptography) with technical assessments: crypto inventory, evaluation of NIST PQC standards (ML-KEM, ML-DSA, SLH-DSA), and migration readiness of systems and pipelines
• From time to time, you conduct DORA-compliant application risk assessments and manage observation tracking and remediation follow-up with first-line teams
• You support internal and regulatory audits (DORA, BaFin, internal audit) and contribute to EU AI Act implementation as a second-line function towards product teams and 1LoD

Your profile:

• You have a background in software engineering or computer science: you have developed and shipped software, can read code, and understand what a CI/CD pipeline does; the programming language is secondary, but the hands-on experience is not
• You have at least 2 years of professional experience in product delivery, DevOps, or a related engineering field, with a genuine interest in application security, cloud security, or secure development practices
• You have picked up security concepts through your engineering work, whether via OWASP, CTF participation, open source security contributions, or hands-on use of security tooling (SAST/DAST, container security, SBOM)
• You can assess what is critical and what is not, even without a formal framework, and you communicate findings clearly to both technical and non-technical audiences
• You have worked in an agile environment like SCRUM, Kanban or with OKRs
• Knowledge of cloud security (preferably GCP or Azure), regulatory frameworks (DORA, EU AI Act, CRA), or security certifications (AWS/GCP Security, OSCP, or equivalent) rounds off your profile
• Proficiency in written and spoken English; German language skills are an asset