Your Responsibilities

As Information Security Manager – Risk Management (m/f/d), you will run our information security risk management end-to-end – from the first report of a concern to the quarterly risk report for our C-Level – based on our own scenario-based, quantitative Security Risk Method. In addition, you will be responsible for the information security part of our third-party risk management and support your colleagues with our internal control framework and audits.

Your responsibilities include:

• You are part of our Information Security & BCM organization (CISO area) and will be the go-to Person for security risk and supplier security risk across our group entities.
• You will triage reported concerns, moderate the framing of risk scenarios with Risk Owners, and lead estimation workshops with Cloud Operations, Engineering, Legal, Data Protection, Sales and Customer Success.
• You will estimate frequencies and losses, rate confidence, calculate the expected annual loss and run the plausibility checks – making sure every figure is consistent, comparable and traceable.
• You will assess the efficiency of treatments, prepare treatment and acceptance decisions, consolidate the risk portfolio quarterly and prepare the C-Level report together with the CISO.
• You will evaluate suppliers across the entire lifecycle – from scoping, questionnaires, SOC 2 reports and ISO certificates to contract requirements, the security result and annual reassessments – and link their findings to our risk portfolio.
• You will support your colleagues in maintaining our internal control framework and in internal and external audits such as ISO 27001 and SOC 2 Type 2, and answer customer due diligence, RFP and questionnaire requests on risk and supply chain security.
• As sparring partner to the CISO, you will help develop the risk methodology further, train Risk Owners and Business Owners, and actively shape a risk culture in which people are glad to report.

What you need to succeed

• You have a completed degree in (business) informatics, business administration, information security or risk management, or a comparable qualification.
• You have several years of professional experience in information security, IT risk management or GRC and had hands-on responsibility for risk assessments, ideally with a SaaS, cloud or software provider.
• You run risk assessments independently, including complex and novel cases, and you enjoy moderating workshops with technical and business stakeholders.
• You are comfortable with numbers: scenario-based and quantitative risk analysis (e.g., FAIR), th
•