Information Security Manager (w/m/d)

JTL-Software-GmbH; Deutschland; A distancia; EUR 90.000 - 120.000; Jornada completa

Descripción de la vacante

JTL-Software-GmbH is seeking a hands-on Information Security professional to own our ISO/IEC 27001 ISMS end to end. You will run the system, contribute to audits, and maintain policy and risk management across the company, acting as the main liaison for security assessments with customers and partners.

The role emphasizes practical security ownership, certification readiness, evidence quality, and continuous improvement, with English fluency essential for global collaboration.

Formación

• Owns ISO/IEC 27001 ISMS and defended it in front of an external auditor.
• Plans and runs internal audits, writes findings, and drives them to closure with owners.
• Writes policy and control framework and operates ISMS for at least a year.
• Runs the cyber risk register with treatment and acceptance decisions.
• Has technical literacy to assess engineer-provided control evidence.
• Fluent English, both written and spoken.

Responsabilidades

• Run and maintain ISO/IEC 27001:2022 management system: scope, SoA, control ownership, management review.
• Prepare for and defend certification, surveillance, and recertification audits.
• Keep evidence base current and repeatable for audits.
• Own policy and standard framework: authorship, review cycle, approval, publication, versioning.
• Manage cyber risk register: assessment, treatment plans, acceptance decisions, review cadence.
• Serve as the single point of contact for customer security assessments and due diligence.
• Run response cycle for investor portfolio-wide cyber assessment and vendor security assessments.
• Design and run security awareness programme and role-based training.

Conocimientos

ISMS ownership

Internal audits

Policy framework

Risk management

Technical literacy

Fluent English

Educación

Bachelor's degree in IT or security

Descripción del empleo

Your mission

JTL-Software runs e-commerce software that our customers run their businesses on. Customers, partners and stakeholders trust in JTL to secure their information.

JTL-Software runs e-commerce software that our customers run their businesses on. Customers, partners and stakeholders trust in JTL to secure their information.

This role runs JTLs information security management system end to end: the ISO/IEC 27001:2022 ISMS, the internal audit programme, the policy and standard framework, the cyber risk register, and security awareness across the company. The goal is to demonstrate, that JTL successfully has established processes to continuously improve its security capabilities.

This is a hands‑on role in the security team without management responsibility.

ISMS ownership

• Run and maintain the ISO/IEC 27001:2022 management system: scope, Statement of Applicability, control ownership, management review
• Prepare for and defend certification, surveillance and recertification audits
• Keep the evidence base current and collectible, and make it repeatable rather than a scramble before each audit

Internal audit

• Plan and run the internal audit programme against the control set
• Write findings that are specific enough to act on, and drive them to closure with the control owners
• Provide factual assurance to the management team

Policy and standards

• Own the policy and standard framework: authorship, review cycle, approval, publication, versioning

Risk management

• Run the cyber risk register: assessment, treatment plans, acceptance decisions, review cadence

External assurance

• Act as the single point of contact for customer security assessments, questionnaires and due diligence
• Run the response cycle for our investor's portfolio-wide cyber assessment
• Manage third-party and vendor security assessments, and the security half of the vendor onboarding process

Awareness and training

• Design and run the security awareness programme, including role-based training
• Measure whether it changed anything, and change it when it did not

Your profile

• You have personally owned an ISO/IEC 27001 ISMS and defended it in front of an external auditor, through certification, recertification or surveillance. Only advising or having provided implementation guidance is not enough for this role.
• You have planned and run internal audits, written the findings, and driven them to closure
• You have written a policy and control framework and then operated an ISMS on it for at least a year
• You have run a risk register where real treatment and acceptance decisions were made
• technical literacy to look at control evidence from an engineer and tell whether it proves the control
• Fluent English, written and spoken

Why us?

• Remote-first within Germany, with the option to work remotely from eligible countries for up to 180 days per year
• Meal allowance of up to €115 net per month
• Ergonomic workspace allowance for your home office setup
• Regular team events, company-wide gatherings, and summer and Christmas parties to stay connected as a remote-first company
• EGYM Wellpass and JobRad subsidy
• Financial benefits including capital-forming payments (Vermögenswirksame Leistungen) and a company pension scheme

About Us

JTL is one of the leading providers of e-commerce software in the German-speaking region – with around 450 employees across the group and 50,000 customers from a wide range of industries. We develop scalable, flexible solutions for the online retail of the future – from ERP systems to shop and marketplace integrations.

Fairness and respect are part of our everyday practice. Are you committed, curious, and eager to work in a team while taking on responsibility? Are you looking for a job where Monday isn’t the worst day of the week? Then we look forward to receiving your application!