About the job

Our partner is an established, globally leading provider of software solutions for regulatory information management in the life sciences sector. With its headquarters in Frankfurt am Main, the company supports drug authorities, pharmaceutical and biotech companies worldwide in making approval processes efficient, safe and compliant. Through strong growth, the expansion of global customer relationships and the focus on modern cloud and AI technologies, they are currently strengthening the internal information security management team.

Your tasks & challengesISM structure & further development: Participation in the development, operation and continuous development of the information security management system (ISMS) according to recognized standards (e.g. ISO 27001, CSA Cloud Controls Matrix) with the goal of ISO certification by 2028.
Regulatory & Customer Requirements: Support in the implementation of regulatory and customer-specific security requirements (e.g. SOC2 Type2, NIS2, AI Act, Cyber Resilience Act or FedRAMP), especially in the highly regulated life sciences environment.
Risk analysis & measures: Analysis, assessment and tracking of IT and information security risks as well as the derivation of suitable protective measures.
Audits & documentation: Support for customer and certification audits (e.g. through self-assessments, documentation and professional exchange).
Consulting & Cloud Security: Advising internal departments on the introduction and operation of secure IT and cloud services (particularly in AWS and the Microsoft 365 / Entra ID / Defender world) and supporting issues relating to secure software development.
Management of external & future topics: Collaboration with external service providers (e.g. to prepare and support the annual external penetration testing) as well as helping to design strategies for the secure internal use of AI tools.

This is what you bring with youSafety standards: In-depth knowledge of common information security standards (e.g. ISO 27001, BSI IT-Grundschutz, OWASP) as well as secure software development and security best practices
Technical understanding: Basic technical understanding of IT and cloud infrastructures, authentication and authorization concepts as well as common security controls (e.g. evaluation of firewall rules, system hardening according to CIS benchmarks)
Professional breadth: Experience in one or more areas of information security (e.g. IT, cloud or application security, vulnerability management, cryptography or network and database security) - ideally with practical development, software or network experience
Communication strengths: Strong communication and teamwork skills as well as the ability to communicate complex security topics in an understandable manner at eye level
Language skills: We require fluent written and spoken German and English skills (the company language is English)

This is what awaits youFlexibility: Flexible working hours and the option to work hybrid.
Culture & creative scope: Freedom to design, flat hierarchies and collaboration at eye level in an owner-managed company that places great value on a family-friendly working atmosphere.
Development & Events: Active support for your personal and professional development as well as regular company events and team events (Get Together Culture) to strengthen cohesion.

Responsibilities

About the job

Your tasks & challengesISM structure & further development: Participation in the development, operation and continuous development of the information security management system (ISMS) according to recognized standards (e.g. ISO 27001, CSA Cloud Controls Matrix) with the goal of ISO certification by 2028.
Regulatory & Customer Requirements: Support in the implementation of regulatory and customer-specific security requirements (e.g. SOC2 Type2, NIS2, AI Act, Cyber Resilience Act or FedRAMP), especially in the highly regulated life sciences environment.
Risk analysis & measures: Analysis, assessment and tracking of IT and information security risks as well as the derivation of suitable protective measures.
Audits & documentation: Support for customer and certification audits (e.g. through self-assessments, documentation and professional exchange).
Consulting & Cloud Security: Advising internal departments on the introduction and operation of secure IT and cloud services (particularly in AWS and the Microsoft 365 / Entra ID / Defender world) and supporting issues relating to secure software development.
Management of external & future topics: Collaboration with external service providers (e.g. to prepare and support the annual external penetration testing) as well as helping to design strategies for the secure internal use of AI tools.

This is what you bring with youSafety standards: In-depth knowledge of common information security standards (e.g. ISO 27001, BSI IT-Grundschutz, OWASP) as well as secure software development and security best practices
Technical understanding: Basic technical understanding of IT and cloud infrastructures, authentication and authorization concepts as well as common security controls (e.g. evaluation of firewall rules, system hardening according to CIS benchmarks)
Professional breadth: Experience in one or more areas of information security (e.g. IT, cloud or application security, vulnerability management, cryptography or network and database security) - ideally with practical development, software or network experience
Communication strengths: Strong communication and teamwork skills as well as the ability to communicate complex security topics in an understandable manner at eye level
Language skills: We require fluent written and spoken German and English skills (the company language is English)

This is what awaits youFlexibility: Flexible working hours and the option to work hybrid.
Culture & creative scope: Freedom to design, flat hierarchies and collaboration at eye level in an owner-managed company that places great value on a family-friendly working atmosphere.
Development & Events: Active support for your personal and professional development as well as regular company events and team events (Get Together Culture) to strengthen cohesion.