DORA Sub-Project Lead (m/f/d)

MeJuvante GmbH; Gau-Algesheim; On-site; EUR 70,000 - 110,000; Full time

Job summary

MeJuvante GmbH is seeking a dedicated project lead to drive a DORA workstream to completion within a multi-stream program.

You will own planning, steering and reporting to management, coordinating ICT asset management, logging and ITSCM, cryptography, and incident and change management, ensuring the procedures align with SfO and the ISMS.

Responsibilities

• Own planning, steering and control of your DORA sub-project to a formal project-management guideline
• ICT asset & system management: full CMDB documentation to DORA Art. 8, asset lifecycle management to Art. 7, recurring asset controls, capacity management, patch management, vulnerability communication, system hardening baselines
• Logging, DLP & encryption: cross-channel data-loss-prevention concept, sharpened SIEM use cases, risk-based data-in-use encryption, a DORA-compliant minimum logging standard and per-asset logging status evidence
• ITSCM & cryptography: backup requirements derived from business impact analysis, revision of the cryptography policy against DORA, monitoring for weak or obsolete algorithms, full key lifecycle documentation, a central certificate register
• Incident & change management: extend regular and emergency change processes to DORA Art. 10, change classification, ex-post security review, traceability and auditability, ICT incident source definition and DORA-compliant incident documentation in the ticket tool (Art. 17 ff.)
• Secure sub-project goals across time, quality and cost; report in management-ready form
• Align procedures with the information-security committee and the written order (SfO); embed changes in the ISMS

Job description

Permanent role leading one DORA workstream to completion. Four streams are open: ICT asset & system management; logging, DLP & encryption; ITSCM & cryptography; incident & change management.

• Own planning, steering and control of your DORA sub-project to a formal project-management guideline
• ICT asset & system management: full CMDB documentation to DORA Art. 8, asset lifecycle management to Art. 7, recurring asset controls, capacity management, patch management, vulnerability communication, system hardening baselines
• Logging, DLP & encryption: cross-channel data-loss-prevention concept, sharpened SIEM use cases, risk-based data-in-use encryption, a DORA-compliant minimum logging standard and per-asset logging status evidence
• ITSCM & cryptography: backup requirements derived from business impact analysis, revision of the cryptography policy against DORA, monitoring for weak or obsolete algorithms, full key lifecycle documentation, a central certificate register
• Incident & change management: extend regular and emergency change processes to DORA Art. 10, change classification, ex-post security review, traceability and auditability, ICT incident source definition and DORA-compliant incident documentation in the ticket tool (Art. 17 ff.)
• Secure sub-project goals across time, quality and cost; report in management-ready form
• Align procedures with the information-security committee and the written order (SfO); embed changes in the ISMS