IT Security & Compliance Lead – AI Health Tech (Berlin)

Protodigy; Berlin; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Virtual equity (VESOP)

Hybrid work in Berlin Mitte

28 days holiday

Job summary

Protodigy is seeking a dedicated security lead to own security and compliance across cloud, product, and internal IT in a hybrid setup based in Berlin Mitte. You will Harden cloud environments, embed DevSecOps, and drive ISO 27001 and BSI C5 certifications while working closely with the CTO and CEO.

You will manage audits, vendor assessments, and penetration testing, shaping the security baseline and guiding the team on security best practices. Fluency in German and English is required.

Qualifications

• 5+ years in hands-on IT security and compliance roles.
• End-to-end ownership of ISO 27001 and/or BSI C5 certification and audits.
• Practical cloud security on AWS or GCP, including Terraform.
• DevSecOps experience: secure SDLC, threat modelling, vulnerability management.
• Full professional German and English.
• A bachelor's degree.

Responsibilities

• Own security and compliance end to end across cloud, product and internal IT.
• Harden AWS/GCP environments: IAM, networking, encryption, logging, monitoring and detection.
• Embed DevSecOps in the development lifecycle, with threat modelling and vulnerability management alongside engineers.
• Maintain and improve ISO 27001 and BSI C5, leading audits and corrective actions.
• Manage penetration tests, security reviews and vendor assessments.
• Set the internal IT baseline: identity, MDM, devices, access and on/offboarding.
• Train and guide the whole team on security.

Skills

IT security

Compliance

Cloud security

DevSecOps

Threat modelling

Vulnerability management

German & English

Education

Bachelor's degree

Tools

Terraform

Job description

Our client builds AI that turns psychotherapy sessions into finished notes and reports, giving therapists hours back every week. It is a small, async-first team of about ten people in Berlin Mitte, already certified to ISO 27001 and BSI C5. As it scales, it needs one person to own security and compliance completely.

THE ROLE

You will be the company's dedicated security lead, reporting to the CTO and working closely with the CEO. This is hands-on work across cloud, product and internal IT, not policy writing: you harden the platform, embed security in engineering, and keep the certifications strong.

WHAT YOU WILL DO

• Own security and compliance end to end across cloud, product and internal IT
• Harden AWS/GCP environments: IAM, networking, encryption, logging, monitoring and detection
• Embed DevSecOps in the development lifecycle, with threat modelling and vulnerability management alongside engineers
• Maintain and improve ISO 27001 and BSI C5, leading audits and corrective actions
• Manage penetration tests, security reviews and vendor assessments
• Set the internal IT baseline: identity, MDM, devices, access and on/offboarding
• Train and guide the whole team on security

WHAT YOU BRING

• 5+ years in hands-on IT security and compliance roles
• End-to-end ownership of ISO 27001 and/or BSI C5 certification and audits
• Practical cloud security on AWS or GCP, including Terraform
• DevSecOps experience: secure SDLC, threat modelling, vulnerability management
• Full professional German and English
• A bachelor's degree
• Healthcare or sensitive-data environments, MDR/IEC 62304, AI/LLM security or Vanta are all a plus

WHAT IS ON OFFER

• Permanent role with virtual equity (VESOP)
• Full ownership of a core function, with direct access to the founders and CTO
• Hybrid working from Berlin Mitte with up to two home-office days a week; flexible hours, results over hours logged
• A 32-hour (80%) option, 28 days' holiday
• Work that matters: every improvement protects therapists and their patients