Information Security Manager (m/w/d) Cloud

IONOS Group; Berlin; Hybrid; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Hybrid working model

Flexible working hours

Canteen subsidy at some locations

Excellent transport connections

Employee discounts

Employee events and training

Job summary

IONOS Group seeks a seasoned ISMS and risk governance professional to lead the end-to-end risk lifecycle, policy management, and audit coordination across the organization. You will work closely with engineering, cloud operations, and legal teams to maintain robust controls and regulatory readiness.

The role emphasizes cross-functional collaboration, strong communication, and experience with ISO 27001 and other certifications.

Qualifications

• Requires strong risk methodology and clear communication.
• Several years of practical experience with standardized information security management systems and cybersecurity attestations.
• Proven audit and compliance experience in at least two certified domains (ISO/IEC 27001, BSI IT-Grundschutz, BSI C5, or PCI DSS).
• Ability to translate technical concepts into business risk statements.
• Facilitating external audits and liaising with assessors with composure and competence.
• Excellent editorial precision for clear, enforceable corporate policies.
• Experience partnering with engineering and cloud operations teams without bottlenecks.
• Strong facilitation and stakeholder management up to executive leadership.
• Fluent German (C2) and English (C1) in written and spoken communication.
• Nice to have privacy frameworks (ISO 27701), GDPR/NIS-2/DORA knowledge, and cross-framework mapping with modern GRC tooling.

Responsibilities

• Operate and advance ISMS across Scope, Control Catalog, SoA, and Management Review.
• Manage end-to-end risk lifecycle from identification to treatment with central risk register.
• Oversee policy lifecycle: drafting, reviewing, approving, communicating, exception workflows.
• Plan and accompany audits; coordinate evidence collection and corrective actions.
• Contribute to the certification roadmap and expand into international markets.
• Establish audit readiness routines across software dev, IT operations, and corporate units.
• Interface with Privacy, Legal, regulatory bodies, and incident response teams.
• Advise internal teams and external auditors on controls and compliance posture.

Skills

Risk management

Audit coordination

Policy drafting

Stakeholder management

Communication

Executive liaison

GRC tooling

Security controls

Regulatory liaison

Tools

GRC tooling

Job description

Tasks

• Operate and advance our ISMS across core components: Scope, Control Catalog, Statement of Applicability, and Management Review.
• Manage the end-to-end risk lifecycle from identification and evaluation to treatment decisions, maintaining the central risk register with assigned ownership.
• Oversee the full policy lifecycle including drafting, reviewing, approving, communicating, and managing formal exception workflows.
• Plan and accompany internal and external audits, coordinating evidence collection, sampling reviews, and corrective action tracking.
• Contribute to our certification roadmap and prepare its expansion into further international target markets.
• Establish structured audit readiness routines across software development, IT operations, and corporate units.
• Act as the primary interface to Privacy, Legal, regulatory bodies, and incident response teams, managing regulatory notification obligations.
• Serve as a trusted advisor for internal teams, business leaders, and external auditors regarding security controls and compliance posture.

Qualifications

• You combine strong risk methodology with an understanding of operational reality and articulate communication.
• Multiple years of practical experience with standardized information security management systems and cybersecurity attestations.
• Proven audit and compliance experience in at least two certified domains (e.g., ISO/IEC 27001, BSI IT-Grundschutz, BSI C5, or PCI DSS).
• Proficient risk management methodology and the ability to translate technical concepts into sound business risk statements.
• Demonstrated composure and competence in facilitating external audit engagements and liaising with assessors.
• High editorial precision with the ability to draft clear, concise, and enforceable corporate policies.
• Experience partnering with technical engineering and cloud operations teams without imposing administrative bottlenecks.
• Strong facilitation and stakeholder management skills up to executive leadership.
• Business fluency in German (C2 level) and English (minimum C1 level) in both written and spoken communication.
• Nice to have:
  • Familiarity with privacy information management frameworks (e.g., ISO 27701).
  • Knowledge of European regulatory standards such as GDPR, NIS-2, or DORA.
  • Experience with cross-framework control mapping and modern GRC automation tooling.

Note:

At the end of the application process, candidates must undergo a security check. Your consent will be requested in good time during the process.

Benefits

• Hybrid working model.
• Flexible working hours through trust-based working hours.
• At some locations a subsidized canteen and various free drinks.
• Modern office space with very good transport connections.
• Various employee discounts for activities and products.
• Employee events such as summer and winter parties, as well as workshops.
• Numerous training and development opportunities.
• Various health offers, such as sports and health courses.