Effectively develop the ISMS. Reliably support audits. Sustainably embed information security.

As Information Security Officer (ISO), you will support the Chief Information Security Officer (CISO) in the group-wide development and effective implementation of information security. Your focus will be on the continuous improvement of our Information Security Management System (ISMS), supporting internal and external audits, and the sustainable implementation of regulatory and normative requirements. You will combine solid technical expertise with an interest in our COSMO-specific environment and strong practical implementation skills.

Your everyday life – only without everyday life

Example project: Continuously developing the ISMS and audit program

A new regulatory requirement or an identified area for improvement must be incorporated into the ISMS. You analyze the requirements, assess the current state of implementation, and derive concrete adjustments to processes, policies, and controls.

You support relevant stakeholders in the implementation process, verify the effectiveness of the measures, and prepare appropriate documentation. You systematically record findings from internal and external audits and integrate them into the ISMS's continuous improvement process.

Here's how you can contribute:

• You will contribute to the further development and implementation of the information security strategy, guidelines and group-wide procedures.
• With your solid technical knowledge and your practical implementation skills, you will continuously develop the ISMS to meet relevant requirements – for example, according to ISO 27001 including ISO 27018, BSI C5, SOC 2, NIS2 and CRA.
• You actively participate in the continuous improvement process of the ISMS, identify potential areas for improvement, and follow up agreed measures until effective completion.
• You will verify the efficient and effective implementation of information security-relevant processes and controls, particularly within the framework of internal audits, control reviews and management assessments.
• You will be responsible for the audit program with a focus on information security – from preparation and fulfillment of requirements to the support of internal and external audits, and the follow-up of findings and potential improvements.
• You coordinate the provision of reliable evidence for certifications, customer requirements, and regulatory audits.
• You support stakeholders in the design, documentation, and implementation of processes and controls to achieve information security goals.
• You maintain and further develop ISMS documentation, guidelines, procedures, risk assessments, control descriptions and evidence.
• You prepare decision-making documents, status reports, and recommendations for relevant governance bodies.
• You monitor new regulatory, normative and technological developments, assess their relevance for COSMO CONSULT and contribute to the derivation of appropriate measures.

Your environment: Teams, tools, collaboration

Team & Setup:

• You are part of the group-wide information security function and work in an international environment.
• You will coordinate your activities, in particular with the Security Operations Team on IT security issues and the Privacy Team on data protection issues.
• You will work closely with Compliance, Legal, IT and the specialist departments, ensuring clear interfaces in the implementation of information security requirements.
• You support process and control managers in integrating requirements into their processes in a pragmatic, effective and transparent manner.
• You help shape processes and standards and communicate with technical and non-technical stakeholders on an equal footing.

Tools & working methods:

• You work in a structured manner with ISMS, risk, action and audit management processes, as well as the tools used for this purpose.
• You use risk analyses, control checks, key performance indicators and audit findings as a basis for prioritized improvements.
• You further develop processes, guidelines, controls and documentation in a traceable and auditable manner.
• You translate regulatory, normative and technical requirements into clear, actionable recommendations.
• You combine methodological diligence with pragmatic implementation and keep track of measures, responsibilities, deadlines and evidence.

Your learning curve at COSMO CONSULT

Weeks 1–4

You will get to know COSMO CONSULT, our organization, and the relevant stakeholders. You will receive a structured overview of the ISMS, applicable guidelines, key risks and controls, ongoing improvement measures, and the existing audit program. You will be gradually introduced to your future areas of responsibility.

After 3 months

You have a clear understanding of the ISMS, its essential processes and controls, as well as outstanding audit and improvement measures. You will take on initial defined ISMS topics, participate in internal audits, and increasingly develop confidence in independently tracking measures.

After 6 months

You will coordinate defined activities for the continuous improvement of the ISMS, reliably support audits, and ensure structured follow-up of findings and corrective actions. You will develop into a competent contact person for ISMS and audit-related questions for IT, security, privacy, compliance, and other departments.

This is what you bring with you

• You have a good understanding of ISO 27001 and ISO 27002, as well as a solid grasp of NIS2 requirements. Knowledge of BSI standards is an advantage.
• You have initial practical experience with an ISMS, information security processes, controls or audits and would like to further develop your skills in these areas.
• You understand regulatory and normative requirements and can help translate them into comprehensible processes and controls.
• You work in a structured, independent and responsible manner and reliably keep track of agreed measures.
• You impress with your communication skills and team spirit, and you can engage both technical and non-technical stakeholders in a way that is appropriate for the target audience.
• You are inquisitive, want to take on responsibility, and aspire not only to manage topics but to actively drive them forward.
• You continuously develop professionally and personally, and through your example you promote a culture characterized by ambition, responsibility, innovation and excellence.
• You have very good German skills and good English skills, both spoken and written.

What you can expect at COSMO CONSULT

• A role with a clear development perspective and the opportunity to gradually assume more responsibility for the group-wide ISMS.
• Scope for design in the further development of auditable processes, controls, guidelines and evidence.
• International collaboration with Security Operations, Privacy, Compliance, IT and the specialist departments.
• The opportunity to expand one's own knowledge in a targeted manner and at the same time to make a measurable contribution to fulfilling regulatory, normative and customer-specific information security requirements.
• A dynamic environment that demands initiative, a willingness to learn, and pragmatic implementation.
•  

Effectively develop the ISMS. Reliably support audits. Sustainably embed information security.

As Information Security Officer (ISO), you will support the Chief Information Security Officer (CISO) in the group-wide development and effective implementation of information security. Your focus will be on the continuous improvement of our Information Security Management System (ISMS), supporting internal and external audits, and the sustainable implementation of regulatory and normative requirements. You will combine solid technical expertise with an interest in our COSMO-specific environment and strong practical implementation skills.

Your everyday life – only without everyday life

Example project: Continuously developing the ISMS and audit program

A new regulatory requirement or an identified area for improvement must be incorporated into the ISMS. You analyze the requirements, assess the current state of implementation, and derive concrete adjustments to processes, policies, and controls.

You support relevant stakeholders in the implementation process, verify the effectiveness of the measures, and prepare appropriate documentation. You systematically record findings from internal and external audits and integrate them into the ISMS's continuous improvement process.

Here's how you can contribute:

• You will contribute to the further development and implementation of the information security strategy, guidelines and group-wide procedures.
• With your solid technical knowledge and your practical implementation skills, you will continuously develop the ISMS to meet relevant requirements – for example, according to ISO 27001 including ISO 27018, BSI C5, SOC 2, NIS2 and CRA.
• You actively participate in the continuous improvement process of the ISMS, identify potential areas for improvement, and follow up agreed measures until effective completion.
• You will verify the efficient and effective implementation of information security-relevant processes and controls, particularly within the framework of internal audits, control reviews and management assessments.
• You will be responsible for the audit program with a focus on information security – from preparation and fulfillment of requirements to the support of internal and external audits, and the follow-up of findings and potential improvements.
• You coordinate the provision of reliable evidence for certifications, customer requirements, and regulatory audits.
• You support stakeholders in the design, documentation, and implementation of processes and controls to achieve information security goals.
• You maintain and further develop ISMS documentation, guidelines, procedures, risk assessments, control descriptions and evidence.
• You prepare decision-making documents, status reports, and recommendations for relevant governance bodies.
• You monitor new regulatory, normative and technological developments, assess their relevance for COSMO CONSULT and contribute to the derivation of appropriate measures.

Your environment: Teams, tools, collaboration

Team & Setup:

• You are part of the group-wide information security function and work in an international environment.
• You will coordinate your activities, in particular with the Security Operations Team on IT security issues and the Privacy Team on data protection issues.
• You will work closely with Compliance, Legal, IT and the specialist departments, ensuring clear interfaces in the implementation of information security requirements.
• You support process and control managers in integrating requirements into their processes in a pragmatic, effective and transparent manner.
• You help shape processes and standards and communicate with technical and non-technical stakeholders on an equal footing.

Tools & working methods:

• You work in a structured manner with ISMS, risk, action and audit management processes, as well as the tools used for this purpose.
• You use risk analyses, control checks, key performance indicators and audit findings as a basis for prioritized improvements.
• You further develop processes, guidelines, controls and documentation in a traceable and auditable manner.
• You translate regulatory, normative and technical requirements into clear, actionable recommendations.
• You combine methodological diligence with pragmatic implementation and keep track of measures, responsibilities, deadlines and evidence.

Your learning curve at COSMO CONSULT

Weeks 1–4

You will get to know COSMO CONSULT, our organization, and the relevant stakeholders. You will receive a structured overview of the ISMS, applicable guidelines, key risks and controls, ongoing improvement measures, and the existing audit program. You will be gradually introduced to your future areas of responsibility.

After 3 months

You have a clear understanding of the ISMS, its essential processes and controls, as well as outstanding audit and improvement measures. You will take on initial defined ISMS topics, participate in internal audits, and increasingly develop confidence in independently tracking measures.

After 6 months

You will coordinate defined activities for the continuous improvement of the ISMS, reliably support audits, and ensure structured follow-up of findings and corrective actions. You will develop into a competent contact person for ISMS and audit-related questions for IT, security, privacy, compliance, and other departments.

This is what you bring with you

• You have a good understanding of ISO 27001 and ISO 27002, as well as a solid grasp of NIS2 requirements. Knowledge of BSI standards is an advantage.
• You have initial practical experience with an ISMS, information security processes, controls or audits and would like to further develop your skills in these areas.
• You understand regulatory and normative requirements and can help translate them into comprehensible processes and controls.
• You work in a structured, independent and responsible manner and reliably keep track of agreed measures.
• You impress with your communication skills and team spirit, and you can engage both technical and non-technical stakeholders in a way that is appropriate for the target audience.
• You are inquisitive, want to take on responsibility, and aspire not only to manage topics but to actively drive them forward.
• You continuously develop professionally and personally, and through your example you promote a culture characterized by ambition, responsibility, innovation and excellence.
• You have very good German skills and good English skills, both spoken and written.

What you can expect at COSMO CONSULT

• A role with a clear development perspective and the opportunity to gradually assume more responsibility for the group-wide ISMS.
• Scope for design in the further development of auditable processes, controls, guidelines and evidence.
• International collaboration with Security Operations, Privacy, Compliance, IT and the specialist departments.
• The opportunity to expand one's own knowledge in a targeted manner and at the same time to make a measurable contribution to fulfilling regulatory, normative and customer-specific information security requirements.
• A dynamic environment that demands initiative, a willingness to learn, and pragmatic implementation.
•