Isms & Assurance Manager

Aceve; Braga; In loco; EUR 50.000 - 80.000; Tempo pieno

Descrizione del lavoro

Aceve is seeking a Security Governance professional to own and evolve the ISMS framework, ensure evidence integrity, and drive audit readiness across acquisitions and entities. You will translate security requirements into repeatable processes, coach teams on compliance, and coordinate internal and external audits to protect customer trust.

The role emphasizes hands-on ISO 27001 management, NIS2 awareness, and practical risk-based controls with a pragmatic approach to evidence and continual

Competenze

• Hands-on experience running or auditing an ISO 27001 management system, including evidence, nonconformities, corrective action and audits.
• Solid grasp of quality management principles: PDCA, process approach and continual improvement.
• Experience with NIS2 and cyber resilience concepts is advantageous.

Mansioni

• Drive the policy review cycle and keep governing documents controlled and accessible
• Own the compliance evidence base and control monitoring
• Translate requirements into ways of working and advise teams on meeting ISO 27001, NIS2 and Cyber Resilience Act
• Keep one management system by mapping overlapping requirements into a single control set
• Coach through nonconformities, from logging to verified closure
• Run internal audits and process sampling and report findings quarterly
• Coordinate external audits and prepare teams to explain processes with confidence
• Bring acquired companies into the ISMS and align their practices
• Own customer security assurance and respond to questionnaires with evidence-backed inputs
• Follow our posture for ISO 27001, NIS2, Cyber Resilience Act and ISAE 3402 reports
• Use audit results to drive improvements and present to Steering Committee and ELT

Conoscenze

ISO 27001 auditing

risk assessment

root-cause analysis

compliance coaching

clear writing

Formazione

Degree in information security or related field

Descrizione del lavoro

At Aceve, we back the builders of society. Founded in the Nordics and growing across Europe, we build digital tools for the people who construct and maintain our physical world - giving electricians, plumbers, and contractors back their time, clarity, and confidence. With over 900 employees across 8 countries, leading brands in 7 customer markets, and more than €100M in revenue, we're on an ambitious growth journey, and we're just getting started. We're an AI-first company, and we work with grit, openness, and a good dose of joy.

About the role Aceve is ISO 27001 certified as one group: more than forty products, more than 23,000 customers, eight countries, and we keep growing through acquisition. Customers, auditors and our owners all ask the same question in different words: can you show it? This role is how we answer. You own the ISMS framework, hold the evidence, and check that we actually do what our policies say, so gaps get found before an auditor or a customer finds them.

What will you do

Drive the policy review cycle and keep our governing documents controlled and accessible

Own the compliance evidence base and control monitoring, and make sure the evidence reflects how we actually work

Translate requirements into ways of working: advise teams on how to meet ISO 27001, NIS2 and the Cyber Resilience Act, starting from the intent of the requirement and the team's reality, and help them decide how much control is proportionate to the risk

Keep one management system, not three: map overlapping requirements into a single control set, so teams comply once and we can show it for each framework

Coach through nonconformities, not just track them: from logging and owner assignment to a real root cause, a proportionate corrective action and verified closure, so we fix the process rather than the symptom

Run internal audits and process sampling that teach: validate that controls work, show teams what good evidence looks like, and report findings to the Cyber Security Steering Committee every quarter

Coordinate external audits and certification, and prepare teams to explain their own process and show their evidence with confidence

Bring acquired companies into the ISMS: our ISMS is the baseline, and you find the smoothest way in for each company, building on what already works there

Own customer security assurance: keep the trust center and standard answer set current so most questions are answered from them, and answer customer questionnaires and audits from the evidence base, with technical input from your colleagues in cyber

Follow our compliance posture for ISO 27001, NIS2, the Cyber Resilience Act and each ISAE 3402 report.

Use audit results, nonconformity trends and incidents to find recurring weaknesses, and bring improvements to the Steering Committee, the ELT and the annual Management Review

Operate the risk register day to day, and perform supplier security risk assessments, following the method set by the Cybersecurity Program & GRC Lead

We believe you have

Hands-on experience running or auditing an ISO 27001 management system, including evidence, nonconformities, corrective action and audits, from both sides of the table

A solid grasp of quality management principles: the process approach, PDCA, root-cause analysis and continual improvement, and experience auditing processes, not just checking documents

Working knowledge of NIS2, or the curiosity to get there fast

A degree in information security, IT, risk management or a related field, or equivalent practical experience

Experience with ISAE 3402 or similar assurance reporting, and with work across several entities or countries

A knack for keeping many small deadlines moving across many owners, and following through until they're closed

The independence to report a gap plainly, even in entities that see themselves as mature

A coaching mindset: you explain the purpose behind a requirement in plain words, and teams come out of an audit or nonconformity knowing more about their own process than before

Clear writing that works for auditors, customers and colleagues who aren't security people

A pragmatic streak: you know that evidence that's good enough and on time beats a perfect framework nobody uses

Aceve is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Our selection process is conducted continuously and without discrimination, ensuring an equal opportunity for all candidates.