Information Security Assurance Expert (all genders)

METRO AG; Düsseldorf; Vor Ort; EUR 75.000 - 110.000; Vollzeit

Benefits dieser Stelle

30 days holidays

Comprehensive training

Health days & wellbeing

Free gym & campus events

JobTicket discounts

Free parking

Company pension

Daycare centers

Zusammenfassung

METRO AG is hiring an information security assurance professional to plan, execute, and support independent assurance activities across METRO AG and its operating entities. The role provides judgment-driven assessments of control design and effectiveness against internal policies, regulatory requirements, and recognized frameworks—enabling informed risk decisions.

The ideal candidate has 3+ years in cybersecurity assurance, strong communication skills, and fluency in English.

Qualifikationen

• Master’s degree in Information Security, Computer Science, or a related field.
• Minimum 3 years of experience in cybersecurity assurance, control assessment, or information security governance.
• Professional certifications preferred (e.g. CISA, CRISC, ISO 27001 / 42001 Lead Auditor, ISO 27001 / 42001 Lead Implementer, CISSP).
• Solid understanding of cybersecurity controls, governance frameworks, and assurance methodologies.
• Familiarity with regulatory and compliance requirements (e.g. ISO/IEC 27001, NIS 2, GDPR, EU AI Act).
• Strong communication and reporting skills, with the ability to explain technical issues to non-technical stakeholders.
• Experience working in complex, multinational environments is a plus.
• Fluent English required; additional languages are a plus.

Aufgaben

• Plan and perform information security assurance reviews, including control design and effectiveness assessments, thematic reviews, and targeted evaluations across IT and OT environments.
• Assess the design adequacy and operational effectiveness of security controls based on frameworks such as ISO/IEC 27001, ISO/IEC 42001, the NIST Cybersecurity Framework and the NIST AI Risk Management Framework.
• Identify and document control gaps, non-conformities, and risk exposures with proportionate, actionable recommendations.
• Provide subject-matter support to internal and external audit functions as required.
• Collaborate with risk, compliance, and IT teams to track remediation of identified control gaps and ensure timely closure.
• Prepare clear, concise, and well-evidenced assurance reports and recommendations for senior stakeholders.
• Provide guidance to entities and departments in preparing for assurance assessments and building control maturity.
• Support the continuous improvement of the IS assurance program, including methodology, tooling, and automation.

Kenntnisse

Fluent English

Communication skills

Stakeholder communication

Ausbildung

Master’s degree in Information Security / Computer Science

Jobbeschreibung

We are wholesale. We are Cyber Security. We are where people and opportunity meet.

At METRO,we’remore than a global food wholesaler. We are #OneMETRO: adiverse team of over 84,000colleagues across 34 countries, united byone mission:enablingour15 million customersto create meaningful momentsin hospitality and independent trade.

We shape the M withpassion,commitment,and growth mindset.This means taking on responsibility, making our company your company and creating a business together thatremainstrue to its roots but always seeksnewsolutions.

Job Description

Purpose of the Role

To plan, execute, and support independent information security assurance activities across METRO AG and its operating entities. The role provides structured, judgment-driven assessment of the effectiveness, maturity, and alignment of security controls against internal policies, regulatory requirements, and recognized frameworks - enabling informed risk decisions and continuous improvement of the organization’s security posture.

Key Responsibilities

• Plan and perform information security assurance reviews, including control design and effectiveness assessments, thematic reviews, and targeted evaluations across IT and OT environments.
• Assess the design adequacy and operational effectiveness of security controls based on frameworks such as ISO/IEC 27001, ISO/IEC 42001, the NIST Cybersecurity Framework and the NIST AI Risk Management Framework.
• Identify and document control gaps, non-conformities, and risk exposures with proportionate, actionable recommendations.
• Provide subject-matter support to internal and external audit functions as required.
• Collaborate with risk, compliance, and IT teams to track remediation of identified control gaps and ensure timely closure.
• Prepare clear, concise, and well-evidenced assurance reports and recommendations for senior stakeholders.
• Provide guidance to entities and departments in preparing for assurance assessments and building control maturity.
• Support the continuous improvement of the IS assurance program, including methodology, tooling, and automation.

Qualifications

• Master’s degree in Information Security, Computer Science, or a related field.
• Minimum 3 years of experience in cybersecurity assurance, control assessment, or information security governance.
• Professional certifications preferred (e.g. CISA, CRISC, ISO 27001 / 42001 Lead Auditor, ISO 27001 / 42001 Lead Implementer, CISSP).
• Solid understanding of cybersecurity controls, governance frameworks, and assurance and assessment methodologies.
• Familiarity with regulatory and compliance requirements (e.g. ISO/IEC 27001, NIS 2, GDPR, EU AI Act).
• Strong communication and reporting skills, with the ability to explain technical issues to non-technical stakeholders.
• Experience working in complex, multinational environments is a plus.
• Fluent English required; additional languages are a plus.

Additional Information

• Work-life balance: Flexible working hours in agreement with your line manager, 30 days of holidays.
• Training: A comprehensive training offer via our own training center or externally.
• Well-being: Health days with lots of health checks and information about your well-being, company medical care including a range of preventive services, such as flu shots, OTHEB employee assistance program.
• Exciting life on campus: Free gym and sports classes, Rioba coffee bar, canteen with discounted meals for employees, many campus events.
• Discounts: discounted Jobticket as well as discounts in our wholesale stores and at many partner companies.
• Comfort: Good transport connections, free parking spaces, JobBike.
• Company pension plan: You will receive a contribution to your company pension.
• Family driven: Three daycare centers for children on campus, support of holiday camps for children of employees.