Information Security Manager

Returnless / SendDirect B.V.; United States; Remote; USD 101,000 - 146,000; Full time

Benefits offered by this job

Remote-first внутри Германии

Питание: 115 евро/мес

Эргономичное рабочее место дома

Регулярные командные и корпоративные и

EGYM Wellpass и JobRad

Vermögenswirksame Leistungen и пенсион

Пенсионная схема компании

Job summary

Returnless / SendDirect B.V. ищет опытного специалиста по информационной безопасности для управления ISMS по ISO/IEC 27001:2022. Роль требует hands-on участия в security команде без управленческой линии.

Вы будете владеть ISMS, планировать аудиты, поддерживать политику и работать с киберрисками, сохраняя доказательства и взаимодействуя с внешними аудиторами; требуется высокий уровень английского.

Qualifications

• Есть опыт владения ISMS по ISO/IEC 27001 и защиты его на внешнем аудите.
• Планировали и проводили внутренние аудиты, оформляли выводы и доводили до закрытия.
• Разрабатывали политику и рамки контроля и эксплуатировали ISMS не менее года.
• Вели реестр киберрисков и принимали решения по лечению рисков.
• Свободно владеете английским своими устной и письменной формами.

Responsibilities

• Управление и поддержка ISMS по ISO/IEC 27001:2022.
• Подготовка сертификационных и надзорных аудитов, включение наблюдений в план действий.
• Поддержка базы доказательств, обеспечение повторяемости процессов аудита.
• Единственный контакт для клиентских аудитов безопасности и due diligence.
• Управление сторонними и вендорскими оценками безопасности, часть onboarding.
• Разработка и проведение программы осведомленности по безопасности.
• Измерение изменений и коррекция программ при необходимости.

Skills

ISMS владение

Внутренние аудиты

Политика и контроль

Управление рисками

Осведомленность по безопасности

Свободный английский

Job description

Задачи:

JTL-Software runs e-commerce software that our customers run their businesses on. Customers, partners and stakeholders trust in JTL to secure their information. This role runs JTLs information security management system end to end: the ISO/IEC 27001:2022 ISMS, the internal audit programme, the policy and standard framework, the cyber risk register, and security awareness across the company. The goal is to demonstrate, that JTL successfully has established processes to continuously improve its security capabilities. This is a hands-on role in the security team without management responsibility. ISMS ownership Run and maintain the ISO/IEC 27001:2022 management system: scope, Statement of Applicability, control ownership, management review Prepare for and defend certification, surveillance and recertification audits Keep the evidence base current and collectible, and make it repeatable rather than a scramble before each audit Internal audit Plan and run the internal audit programme against the control set Write findings that are specific enough to act on, and drive them to closure with the control owners Provide factual assurance to the management team Policy and standards Own the policy and standard framework: authorship, review cycle, approval, publication, versioning Risk management Run the cyber risk register: assessment, treatment plans, acceptance decisions, review cadence External assurance Act as the single point of contact for customer security assessments, questionnaires and due diligence Run the response cycle for our investor's portfolio-wide cyber assessment Manage third-party and vendor security assessments, and the security half of the vendor onboarding process Awareness and training Design and run the security awareness programme, including role-based training Measure whether it changed anything, and change it when it did not

Требования:

You have personally owned an ISO/IEC 27001 ISMS and defended it in front of an external auditor, through certification, recertification or surveillance. Only advising or having provided implementation guidance is not enough for this role. You have planned and run internal audits, written the findings, and driven them to closure You have written a policy and control framework and then operated an ISMS on it for at least a year You have run a risk register where real treatment and acceptance decisions were made technical literacy to look at control evidence from an engineer and tell whether it proves the control Fluent English, written and spoken

Условия:

• Remote-first within Germany, with the option to work remotely from eligible countries for up to 180 days per year
• Meal allowance of up to €115 net per month
• Ergonomic workspace allowance for your home office setup
• Regular team events, company-wide gatherings, and summer and Christmas parties to stay connected as a remote-first company
• EGYM Wellpass and JobRad subsidy
• Financial benefits including capital-forming payments (Vermögenswirksame Leistungen) and a company pension scheme