Principal of Information Security (f/m/d)

Orbem; München; Hybrid; EUR 120.000 - 180.000; Vollzeit

Benefits dieser Stelle

Stock Options

Relocation Support

Learning & Development

Fitness Membership

Childcare Reimbursement

Deutschland Ticket

Flexible Hours & Home Office

Zusammenfassung

Orbem, headquartered in Munich, is scaling its security function as a hands-on senior practitioner. You will own the ISMS, drive the ISO 27001 re-audit, and shape security governance across product, governance, and external partner relationships.

You will operate with strategic judgment, yet perform operational security tasks, collaborating with executives and engineers to embed controls into practice.

Qualifikationen

• Experience navigating an ISO 27001 re-audit.
• Proven track record leading security programs at scale.
• Hands-on ability to implement security controls and write policies.

Aufgaben

• Lead ISO 27001 re-audit strategy and execution.
• Set and govern Orbem's information security strategy and risk appetite.
• Own the information security risk register end-to-end.
• Represent Orbem externally with auditors, customers, and regulators as CISO.
• Advise leadership on security risk in product, GTM, and expansion.
• Oversee operational security processes and vendor risk management.
• Own ISMS governance, evidence collection, and internal audits.
• Lead incident response as incident commander with Security Engineering.

Kenntnisse

ISO 27001 experience

Security leadership

Hands-on security

Regulatory knowledge

AI/ML security context

Clear communication

Jobbeschreibung

We see the potential inside everything and everyone. Starting with you.

Help us see what's possible. Join us.

Orbem uses AI to industrialize MRI, delivering non-invasive insight into everything from fruits to eggs to the human body. We are transforming what is becoming the world's largest biological dataset into actionable intelligence to reduce waste, increase quality, and accelerate the shift toward a more sustainable and healthier future.

Headquartered and founded in Munich, Germany, with an office now in Houston, Texas, our world-class team is scaling inside-out technology to transform how humanity sees and understands biological matter.

Your Role

You will own Orbem's Information Security function end-to-end at a pivotal moment.

Orbem achieved ISO 27001 certification in December 2025. We are now entering an active stabilization phase: controls are established, our external provider stack is being restructured, and a re-audit sits on the horizon. You will inherit this reality — and the authority to shape it.

This is a role for a hands-on, senior security practitioner who wants to shape a security function, not just run one — someone who thrives in ambiguity, makes high-stakes strategic calls with incomplete information, and can do the operational work themselves while orchestrating a deliberate external provider stack. Although we are looking for a strategist, you will also be required to support day-to-day security operations.

Your Day-to-Day

• Lead our approach to the upcoming ISO 27001 re-audit. Assess the situation, make the strategic recommendation, and own the execution.
• Set and maintain Orbem's information security strategy aligned with our stage, our customers (enterprise food today, healthcare in our strategic line of sight), and our risk appetite.
• Own the information security risk register end-to-end: build it where needed, maintain it, and run the risk review with key leadership peers.
• Represent Orbem externally with auditors, enterprise customer security teams, and regulators in the CISO capacity.
• Advise the leadership team on information security risk in product, go-to-market, and expansion decisions, including healthcare readiness planning.
• Own and continuously improve key operational security processes — including how we assess and manage risk across our vendor and supplier base, how security is embedded in key business workflows, and how we ensure controls translate from policy into practice.
• Bring policies and controls to life. Identify which controls are most material, which to operationalize further, and which to consolidate — in partnership with the teams who will execute them.
• Own the ISMS governance structure — ensuring that control reviews, evidence collection, management reviews, and internal audits happen to a high standard, whether through direct execution, external support, or a combination.
• Lead incident response as incident commander for security-relevant events, with the Security Engineering team as technical co-lead.
• Write clear policies, clear communications, clear decisions. You will author or co-author most of the security-related writing that leaves this function.

Orchestrating the External Stack & Lateral Leadership (approx 20%)

• Manage a deliberate external provider stack. You will not build everything in-house. You will orchestrate a set of external partners — examples include audit preparation support, data protection advisory services, a managed security service provider, penetration testing, and an ISMS and compliance management platform. For each, you contribute to the build-vs-buy decision and own the ongoing relationship.
• Collaborate closely with the Security Engineering team through a close working relationship that connects governance and technical security.
• Co-build a Security Ambassadors network with the Security Engineering team — empowered technical leads across business teams who champion security in their own context.
• Leverage AI and automation aggressively across the security programme — compliance evidence collection, vendor review, policy drafting, user training, awareness — to keep the function lean.

How You Fit In

This is an individual contributor role at Principal level. Your influence is lateral, not hierarchical. You will work alongside the General Counsel, the Corporate Operations lead, the Procurement & Supply Chain lead, and the Security Engineering team. You will interact with the full executive team on security-relevant decisions.

Your Experience and Skills

• Scale-up security leadership experience. You have been the #1 or #2 information security compliance person at a company in the 150-600 FTE range.
• ISO 27001 lived experience. You have personally guided a company through an ISO 27001 cycle. You can make a credible audit strategy recommendation because you have seen the consequences of each option in practice.
• Hands-on operator. You have personally set up security processes and controls — not only specified or overseen them. You are comfortable running a security register, writing policies, running workshops, and sitting in working meetings to ship work.
• Comfort without a large team. You are motivated by being the person in the room, not the person who built the room.
• Resilience. Security leadership means making hard calls — sometimes unpopular ones, sometimes under time pressure. You are energised by that responsibility, not deterred by it. You stand behind your decisions and own the business outcomes.
• Communication. You can translate security risk into business decisions for a non-security executive team, and technical specifics for engineers. You write and speak clearly.

What Makes You Stand Out

• Experience navigating an ISO 27001 re-audit.
• Familiarity with the European regulatory landscape (GDPR, NIS2, EU AI Act) and a working understanding of US frameworks (SOC 2).
• Deep-tech, AI/ML, or industrial product context. Our security surface is not SaaS-shaped - edge devices, hardware, industrial customers, imaging data.
• Experience working with and evaluating external security and compliance service providers.
• Comfort with AI-first working. We expect you to use AI to compress the work - and to own the output, not just the prompt. You also bring an informed view on how to monitor and govern AI usage internally.

Fit to Our Values

• We Own Every Challenge: we enjoy complexity and thrive under uncertainty.
• We Strive for Better: we seize any opportunity for growth and challenge the status quo. We are constantly learning and improving.
• We Imagine New Frontiers: we think beyond "doable" and "reasonable". We design a sustainable and healthy future together.

What We Offer

International Environment:

• Join a team with 40+ nationalities across 5 continents, all driven by a shared purpose: shedding light on the world's toughest challenges.
• Stock Options: Share in Orbem's success.
• Relocation Support: Seamless support for your move to Germany.
• Learning & Development: €1,750 annual budget for personal growth.
• Fitness Membership: Access to Urban Sports Club or Wellpass.
• Childcare Reimbursement: Support for Kita/Kindergarten fees.
• Deutschland Ticket: Full coverage of public transportation.

Work-Life Integration:

• Flexible Hours & Home Office: Work when and where it suits you.
• WFH Perks: Get €185 to upgrade your home office + an external monitor on us!
• 30 Days Paid Leave: Plenty of time to recharge.
• Personal