Head of Information Security (m/f/d)

Chrono24; Pachuca; Presencial; MXN 1.792.828 - 2.390.438; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Permanent contract

30 days vacation

HQ Karlsruhe meal included

International travel up to 20 days/yr

Descripción de la vacante

Chrono24 is seeking a Head of Information Security to own and drive the security program from strategy to hands‑on execution. You will partner with Product & Technology to embed security across engineering practices and ensure readiness of incident response and audits.

You will lead a team including an IS Officer and Principal Security Engineer, manage third‑party risk, and drive a continuous security awareness culture worldwide.

Formación

• Technical background in software engineering, DevOps, or similar with years of information security experience.
• Deep understanding of ISMS frameworks, especially ISO 27001, risk management, incident response, and vulnerability management.
• Strong communication skills to translate security topics to technical and executive audiences.

Responsabilidades

• Define and drive information security strategy and roadmap for Chrono24, aligned with objectives and regulatory requirements.
• Own governance, risk management, and compliance across the organization.

Conocimientos

Information security

ISMS ISO27001

Incident response

Vulnerability management

Security awareness

Cloud security

Stakeholder communication

English effectively

Herramientas

AWS

GCP

SSDLC

Descripción del empleo

About

As Head of Information Security (m/f/d) you will own and drive Chrono24’s information security program, combining strategic leadership with hands‑on execution to protect a platform trusted by millions of watch enthusiasts worldwide.

Responsibilities

• You define and drive the information security strategy and roadmap for Chrono24, aligning with business objectives and regulatory requirements including ISO 27001,NIS2, and CRA.
• You own information security governance, risk management, and compliance across the organization, ensuring risk owners understand and act on their responsibilities.
• You lead and coordinate incident response, overseeing our Security Incident Response Team (SIRT) processes and ensuring readiness when it matters.
• You steer our vulnerability management program, coordinating internal scans, external assessments, and take responsibility for our bug bounty program.
• You build and run the security awareness program, including phishing campaigns, training, and fostering a security‑conscious culture company‑wide.
• You assess and manage third‑party and vendor security risks, ensuring our partners and service providers meet our security standards.
• You drive audit readiness and compliance, coordinating ISO 27001 audits, NIS2 preparation, and collaboration with external auditors and your Information Security Officer.
• You contribute to business continuity management, ensuring security considerations are embedded in our continuity processes.

Team

Your direct team consists of a Principal Security Engineer and an Information Security Officer. The Principal Security Engineer owns application security and our Secure Software Development Lifecycle (SSDLC), including secure coding standards, vulnerability management, penetration testing, and cryptography controls. The Information Security Officer manages ISMS operations, compliance documentation, and audit coordination. Beyond your direct team, you will work closely with Product & Technology, especially Platform Engineering, DevOps, and IT, to embed security into engineering practices.

Qualifications

• A technical background in software engineering, DevOps, or a comparable discipline, combined with several years of professional experience in information security.
• Deep understanding of ISMS frameworks, particularly ISO 27001, with hands‑on experience in risk management, incident response, and vulnerability management.
• Strong communication skills with the ability to translate security topics for both technical teams and executive leadership.
• A collaborative, pragmatic approach to working with cross‑functional teams, external partners, and senior stakeholders.
• Very good English skills; German proficiency is a big plus.
• Bonus points for relevant certifications (CISSP, CISM, ISO 27001 Lead Auditor/Implementer), experience with NIS2 compliance, or familiarity with cloud security (AWS, GCP).
• Watch expertise is not required – we’ll teach you everything you need to know.

Benefits

• Salary: 90,000 to 120,000 EUR annually, depending on experience.
• No back doors: permanent employment contracts only.
• 30 days of vacation per year.
• Working from HQ in Karlsruhe includes a free daily meal.
• Additional time off on December 24th and 31st.
• Work abroad for up to 20 days per year with a sea view option.

Diversity

Chrono24 believes in the power of diversity and strives to create an inclusive environment where everyone can thrive.