InfoSec & Risk Manager — ISO 27001, DORA, Audits

Qwist Group; United States; Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Impact & Ownership

Flexibility: Hybrid across Berlin &amp

Personal growth

Pioneering spirit

Job summary

Qwist Group is seeking an Information Security Manager to own the ISMS under ISO 27001 and lead the ICT Risk Management Function under DORA. You will work closely with Engineering and Platform to embed security into development and serve as the central point for audits.

You will drive risk assessment, incident classification, third‑party risk oversight, and business continuity planning, reporting to the Management Board and collaborating with the Chief Legal Officer.

Qualifications

• Degree or qualification in information security, CS, law/compliance or equivalent.
• Hands-on ISO 27001 ISMS ownership including documentation and controls.
• Experience collaborating with software engineering, product or DevOps teams.
• Knowledge of DORA; exposure to MaRisk or similar frameworks welcome.
• Strong analytical thinking and ability to manage multiple topics and stakeholders.
• Proficient in German and English, with technical and non-technical audiences.

Responsibilities

• Hold the ICT Risk Management Function under DORA and classify ICT incidents.
• Develop and operate the ISO 27001 ISMS and lead certification and surveillance audits.
• Own audit evidence for DORA and ISO 27001; coordinate with internal and external audits.
• Embed security into development with Engineering, Platform and DevOps.
• Support business continuity and disaster recovery planning with testing.
• Assess and classify ICT services under DORA and oversee third parties.
• Lead security operations including penetration testing and incident response.

Skills

Security mindset

Analytical thinking

Stakeholder management

German & English communication

Education

Degree in information security, CS, law/compliance

Job description

Qwist Group is seeking an Information Security Manager to own the ISMS under ISO 27001 and lead the ICT Risk Management Function under DORA. You will work closely with Engineering and Platform to embed security into development and serve as the central point for audits.

You will drive risk assessment, incident classification, third‑party risk oversight, and business continuity planning, reporting to the Management Board and collaborating with the Chief Legal Officer.