ISMS & Assurance Manager

Aceve; Lisboa; On-site; EUR 60,000 - 90,000; Full time

Job summary

Aceve is seeking an experienced information security professional to own and operate our ISMS, aligning with ISO 27001, NIS2, and the Cyber Resilience Act, and driving evidence gathering across multiple countries.

You will lead audits, manage nonconformities, coach teams, and ensure the evidence base supports external audits and customer requests; a pragmatic, policy-to-practice mindset is essential.

Qualifications

• Hands-on experience running or auditing ISO 27001 management systems, including evidence, nonconformities, corrective action and audits.
• Solid grasp of quality management principles: PDCA, root-cause analysis and continual improvement.
• Working knowledge of NIS2 and cyber risk frameworks.
• Experience with ISAE 3402 or similar assurance reporting across entities or countries.
• Ability to manage multiple deadlines and report gaps clearly.

Responsibilities

• Drive the policy review cycle and keep governing documents controlled and accessible.
• Own the compliance evidence base and control monitoring, ensuring evidence reflects actual practice.
• Translate requirements into working practices and advise teams on meeting ISO 27001, NIS2, and the Cyber Resilience Act.
• Map overlapping requirements into a single control set for unified compliance.
• Coach through nonconformities with root cause analysis and proportionate corrective actions.
• Run internal audits and process sampling to validate controls and inform leadership.
• Coordinate external audits and certifications, guiding teams to present evidence confidently.
• Onboard acquired companies into the ISMS and integrate with existing controls.
• Manage customer security assurance and respond to questionnaires with the evidence base.
• Follow posture for ISO 27001, NIS2, the Cyber Resilience Act and ISAE 3402 reports.
• Use audit results to identify weaknesses and drive improvements with governance.
• Operate the risk register day-to-day and perform supplier security risk assessments.

Skills

ISO 27001

NIS2

ISMS

Audit experience

Risk assessment

Education

Degree in information security

Job description

At Aceve, we back the builders of society. Founded in the Nordics and growing across Europe, we build digital tools for the people who construct and maintain our physical world - giving electricians, plumbers, and contractors back their time, clarity, and confidence. With over 900 employees across 8 countries, leading brands in 7 customer markets, and more than €100M in revenue, we're on an ambitious growth journey, and we're just getting started. We're an AI-first company, and we work with grit, openness, and a good dose of joy.

About the role

Aceve is ISO 27001 certified as one group: more than forty products, more than 23,000 customers, eight countries, and we keep growing through acquisition. Customers, auditors and our owners all ask the same question in different words: can you show it? This role is how we answer. You own the ISMS framework, hold the evidence, and check that we actually do what our policies say, so gaps get found before an auditor or a customer finds them.

What will you do

• Drive the policy review cycle and keep our governing documents controlled and accessible
• Own the compliance evidence base and control monitoring, and make sure the evidence reflects how we actually work
• Translate requirements into ways of working: advise teams on how to meet ISO 27001, NIS2 and the Cyber Resilience Act, starting from the intent of the requirement and the team's reality, and help them decide how much control is proportionate to the risk
• Keep one management system, not three: map overlapping requirements into a single control set, so teams comply once and we can show it for each framework
• Coach through nonconformities, not just track them: from logging and owner assignment to a real root cause, a proportionate corrective action and verified closure, so we fix the process rather than the symptom
• Run internal audits and process sampling that teach: validate that controls work, show teams what good evidence looks like, and report findings to the Cyber Security Steering Committee every quarter
• Coordinate external audits and certification, and prepare teams to explain their own process and show their evidence with confidence
• Bring acquired companies into the ISMS: our ISMS is the baseline, and you find the smoothest way in for each company, building on what already works there
• Own customer security assurance: keep the trust center and standard answer set current so most questions are answered from them, and answer customer questionnaires and audits from the evidence base, with technical input from your colleagues in cyber
• Follow our compliance posture for ISO 27001, NIS2, the Cyber Resilience Act and each ISAE 3402 report.
• Use audit results, nonconformity trends and incidents to find recurring weaknesses, and bring improvements to the Steering Committee, the ELT and the annual Management Review
• Operate the risk register day to day, and perform supplier security risk assessments, following the method set by the Cybersecurity Program & GRC Lead

We believe you have

• Hands-on experience running or auditing an ISO 27001 management system, including evidence, nonconformities, corrective action and audits, from both sides of the table
• A solid grasp of quality management principles: the process approach, PDCA, root-cause analysis and continual improvement, and experience auditing processes, not just checking documents
• Working knowledge of NIS2, or the curiosity to get there fast
• A degree in information security, IT, risk management or a related field, or equivalent practical experience
• Experience with ISAE 3402 or similar assurance reporting, and with work across several entities or countries
• A knack for keeping many small deadlines moving across many owners, and following through until they're closed
• The independence to report a gap plainly, even in entities that see themselves as mature
• A coaching mindset: you explain the purpose behind a requirement in plain words, and teams come out of an audit or nonconformity knowing more about their own process than before
• Clear writing that works for auditors, customers and colleagues who aren't security people
• A pragmatic streak: you know that evidence that's good enough and on time beats a perfect framework nobody uses

Aceve is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Our selection process is conducted continuously and without discrimination, ensuring an equal opportunity for all candidates.