DORA Sub-Project Lead

MeJuvante GmbH; Frankfurt; Vor Ort; EUR 90.000 - 120.000; Vollzeit

Zusammenfassung

MeJuvante GmbH in Frankfurt is seeking a permanent lead for a DORA workstream, responsible for guiding one sub-project through to formal project-management guidelines while overseeing four streams including IT asset management, logging/DLP/encryption, ITSCM/cryptography and incident/change management.

The role requires coordinating with the information-security committee, ensuring DORA alignment, and embedding changes into the ISMS across time, quality and cost constraints to deliver

Aufgaben

• Own planning, steering and control of your DORA sub-project to a formal project-management guideline
• ICT asset & system management: full CMDB documentation to DORA Art. 8, asset lifecycle management to Art. 7, recurring asset controls, capacity management, patch management, vulnerability communication, system hardening baselines
• Logging, DLP & encryption: cross-channel data-loss-prevention concept, sharpened SIEM use cases, risk-based data-in-use encryption, a DORA-compliant minimum logging standard and per-asset logging status evidence
• ITSCM & cryptography: backup requirements derived from business impact analysis, revision of the cryptography policy against DORA, monitoring for weak or obsolete algorithms, full key lifecycle documentation, a central certificate register
• Incident & change management: extend regular and emergency change processes to DORA Art. 10, change classification, ex-post security review, traceability and auditability, ICT incident source definition and DORA-compliant incident documentation in the ticket tool (Art. 17 ff.)
• Secure sub-project goals across time, quality and cost; report in management-ready form
• Align procedures with the information-security committee and the written order (SfO); embed changes in the ISMS

Jobbeschreibung

Permanent role leading one DORA workstream to completion. Four streams are open: ICT asset & system management; logging, DLP & encryption; ITSCM & cryptography; incident & change management.

• Own planning, steering and control of your DORA sub-project to a formal project-management guideline
• ICT asset & system management: full CMDB documentation to DORA Art. 8, asset lifecycle management to Art. 7, recurring asset controls, capacity management, patch management, vulnerability communication, system hardening baselines
• Logging, DLP & encryption: cross-channel data-loss-prevention concept, sharpened SIEM use cases, risk-based data-in-use encryption, a DORA-compliant minimum logging standard and per-asset logging status evidence
• ITSCM & cryptography: backup requirements derived from business impact analysis, revision of the cryptography policy against DORA, monitoring for weak or obsolete algorithms, full key lifecycle documentation, a central certificate register
• Incident & change management: extend regular and emergency change processes to DORA Art. 10, change classification, ex-post security review, traceability and auditability, ICT incident source definition and DORA-compliant incident documentation in the ticket tool (Art. 17 ff.)
• Secure sub-project goals across time, quality and cost; report in management-ready form
• Align procedures with the information-security committee and the written order (SfO); embed changes in the ISMS