Isms & Assurance Manager

Aceve; Viseu; On-site; EUR 48,000 - 70,000; Full time

Job summary

Aceve in Portugal seeks an ISMS Lead to own ISO 27001 and related standards across multiple entities. You will manage evidence, drive audits, and ensure controls reflect policy with a risk-based approach.

You translate requirements into practical workflows for ISO 27001, NIS2 and the Cyber Resilience Act, coach teams through nonconformities, and coordinate audits to sustain certification and customer trust.

Qualifications

• Hands-on experience running or auditing an ISO 27001 management system.
• Strong understanding of risk-based controls and evidence handling.
• Experience with NIS2 or Cyber Resilience Act helpful.

Responsibilities

• Drive the policy review cycle and keep governing documents controlled and accessible
• Own the compliance evidence base and control monitoring, and ensure evidence reflects actual work
• Translate requirements into practical workflows: ISO 27001, NIS2 and Cyber Resilience Act, aligning controls to risk
• Keep one management system by mapping overlapping requirements into a single control set
• Coach through nonconformities with root cause analysis and proportionate corrective action
• Run internal audits and process sampling and report findings to the Steering Committee quarterly
• Coordinate external audits and certification, and prepare teams to explain their process and evidence
• Bring acquired companies into the ISMS and integrate them smoothly
• Own customer security assurance and respond to questionnaires with evidence
• Follow ISO 27001, NIS2, Cyber Resilience Act and ISAE 3402 postures
• Use audit results and incidents to drive improvements to Steering Committee and annual Management Review
• Operate the risk register day to day and perform supplier security risk assessments

Skills

ISO 27001

Auditing

Policy implementation

Risk assessment

Stakeholder coaching

Education

Degree in information security / IT risk management

Equivalent practical experience

Job description

At Aceve, we back the builders of society. Founded in the Nordics and growing across Europe, we build digital tools for the people who construct and maintain our physical world - giving electricians, plumbers, and contractors back their time, clarity, and confidence. With over 900 employees across 8 countries, leading brands in 7 customer markets, and more than €100M in revenue, we're on an ambitious growth journey, and we're just getting started. We're an AI-first company, and we work with grit, openness, and a good dose of joy.

About the role Aceve is ISO 27001 certified as one group: more than forty products, more than 23,000 customers, eight countries, and we keep growing through acquisition. Customers, auditors and our owners all ask the same question in different words: can you show it? This role is how we answer. You own the ISMS framework, hold the evidence, and check that we actually do what our policies say, so gaps get found before an auditor or a customer finds them.

What will you do

Drive the policy review cycle and keep our governing documents controlled and accessible

Own the compliance evidence base and control monitoring, and make sure the evidence reflects how we actually work

Translate requirements into ways of working: advise teams on how to meet ISO 27001, NIS2 and the Cyber Resilience Act, starting from the intent of the requirement and the team's reality, and help them decide how much control is proportionate to the risk

Keep one management system, not three: map overlapping requirements into a single control set, so teams comply once and we can show it for each framework

Coach through nonconformities, not just track them: from logging and owner assignment to a real root cause, a proportionate corrective action and verified closure, so we fix the process rather than the symptom

Run internal audits and process sampling that teach: validate that controls work, show teams what good evidence looks like, and report findings to the Cyber Security Steering Committee every quarter

Coordinate external audits and certification, and prepare teams to explain their own process and show their evidence with confidence

Bring acquired companies into the ISMS: our ISMS is the baseline, and you find the smoothest way in for each company, building on what already works there

Own customer security assurance: keep the trust center and standard answer set current so most questions are answered from them, and answer customer questionnaires and audits from the evidence base, with technical input from your colleagues in cyber

Follow our compliance posture for ISO 27001, NIS2, the Cyber Resilience Act and each ISAE 3402 report.

Use audit results, nonconformity trends and incidents to find recurring weaknesses, and bring improvements to the Steering Committee, the ELT and the annual Management Review

Operate the risk register day to day, and perform supplier security risk assessments, following the method set by the Cybersecurity Program & GRC Lead

We believe you have

Hands-on experience running or auditing an ISO 27001 management system, including evidence, nonconformities, corrective action and audits, from both sides of the table

A solid grasp of quality management principles: the process approach, PDCA, root-cause analysis and continual improvement, and experience auditing processes, not just checking documents

Working knowledge of NIS2, or the curiosity to get there fast

A degree in information security, IT, risk management or a related field, or equivalent practical experience

Experience with ISAE 3402 or similar assurance reporting, and with work across several entities or countries

A knack for keeping many small deadlines moving across many owners, and following through until they're closed

The independence to report a gap plainly, even in entities that see themselves as mature

A coaching mindset: you explain the purpose behind a requirement in plain words, and teams come out of an audit or nonconformity knowing more about their own process than before

Clear writing that works for auditors, customers and colleagues who aren't security people

A pragmatic streak: you know that evidence that's good enough and on time beats a perfect framework nobody uses

Aceve is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Our selection process is conducted continuously and without discrimination, ensuring an equal opportunity for all candidates.