Information Security Manager (m/w/d) Cloud

WebHosting; Berlin; Hybrid; EUR 90,000 - 130,000; Full time

Job summary

WebHosting is seeking an Information Security Manager (m/w/d) for cloud security. The role is hybrid and focuses on advancing the ISMS, managing risk, and guiding policy and audit activities across the organization.

You will collaborate with Privacy, Legal, and regulatory teams to ensure robust security controls and compliance posture. Ideal candidates will have hands-on experience with governance, risk, and compliance in cloud environments, with a focus on GDPR, NIS-2, and DORA.

Qualifications

• Experience managing an ISMS and security certifications.
• Ability to manage risk lifecycle from identification to treatment.
• Experience drafting and governing security policies and exception workflows.
• Plan and coordinate internal and external audits.
• Contribute to certification roadmaps and multi-market expansion.
• Establish audit readiness across development, IT operations, and corporate units.
• Interface with Privacy, Legal, regulators, and incident response teams.
• Nice to have familiarity with privacy frameworks (ISO 27701) and GDPR/NIS-2/DORA.

Responsibilities

• Operate and advance ISMS across scope, control catalog, Statement of Applicability, and Management Review.
• Manage the end-to-end risk lifecycle with a central risk register and ownership.
• Oversee the full policy lifecycle including drafting, reviewing, approving, and exception workflows.
• Plan and accompany internal and external audits, coordinating evidence collection and corrective actions.
• Contribute to our certification roadmap and expansion into international target markets.
• Establish structured audit readiness routines across software development, IT operations, and corporate units.
• Act as the primary interface to Privacy, Legal, regulatory bodies, and incident response teams.

Skills

ISMS management

Risk management

Policy governance

Audits & compliance

Regulatory knowledge

Incident response

Stakeholder management

GDPR / privacy guidance

Job description

Information Security Manager (m/w/d) Cloud

Hybrid Full-time Not specified Security

Job Description

About IONOS

At IONOS, we don’t just manage servers – we shape the digital future for more than 6.2 million customers worldwide with our solutions. As Europe’s leading hosting provider and a pioneer in independent cloud solutions, we are building next-generation infrastructure – from sovereign cloud architectures and high-performance GPU clusters to integrated AI automation tools.

What drives us is digital sovereignty for Europe and real impact for small and medium-sized businesses (SMBs) as well as large enterprises. We work in agile teams, rely on transparent structures, and believe that excellence and innovation only emerge through true team spirit.

An ISMS delivers real value when teams experience it as a practical enabler and compliance evidence is generated organically from daily operations rather than stressful audit sprints. Together with our existing security team, you will translate normative requirements into actionable policies, guide risk decisions, and steer the ongoing evolution of our security certifications.

Tasks

• Operate and advance our ISMS across core components: Scope, Control Catalog, Statement of Applicability, and Management Review.
• Manage the end-to-end risk lifecycle from identification and evaluation to treatment decisions, maintaining the central risk register with assigned ownership.
• Oversee the full policy lifecycle including drafting, reviewing, approving, communicating, and managing formal exception workflows.
• Plan and accompany internal and external audits, coordinating evidence collection, sampling reviews, and corrective action tracking.
• Contribute to our certification roadmap and prepare its expansion into further international target markets.
• Establish structured audit readiness routines across software development, IT operations, and corporate units.
• Act as the primary interface to Privacy, Legal, regulatory bodies, and incident response teams, managing regulatory notification obligations.
• Serve as a trusted advisor for internal teams, business leaders, and external auditors regarding security controls and compliance posture.
• Nice to have:
  Familiarity with privacy information management frameworks (e.g., ISO 27701).
  Knowledge of European regulatory standards such as GDPR, NIS-2, or DORA.
  Experience with cross-framework control mapping and modern GRC automation tooling.

Note:At the end of the application process, candidates must undergo a security check. Your consent will be requested in good time during the process.

Application Note

We value diversity and welcome all applications – regardless of, for example, gender, nationality, ethnic or social origin, religion, disability, age as well as sexual orientation and identity, physical characteristics, marital status or any other irrelevant factor subject to applicable law.