Role Description Woran Du mit uns arbeitest: - ISMS-Beratung: Aufbau, Implementierung und Weiterentwicklung von Informationssicherheits-Managementsystemen nach etablierten Standards (z. B. ISO/IEC 27001, NIS-2, TISAX, BSI IT-Grundschutz) - Sicherheitsanalyse: Bewertung bestehender Maßnahmen und Prozesse, Identifikation von Schwachstellen und Ableitung von Optimierungspotenzialen - Gap-Analysen & Projektsteuerung: Durchführung von Reifegradanalysen, Planung geeigneter Maßnahmen und Begleitung bis zur erfolgreichen Zertifizierung - Auditvorbereitung: Organisation interner Audits und Mitwirkung bei vertraglich vereinbarten Leistungen wie Reporting, Change-Management, Überwachung - Risikomanagement: Durchführung von Risikoanalysen und Entwicklung technischer und organisatorischer Sicherheitsmaßnahmen - Richtlinien & Schulungen: Erstellung und Weiterentwicklung von Sicherheitsrichtlinien, Leitfäden und Awareness-Konzepten - Schnittstellenarbeit: Enge Zusammenarbeit mit Datenschutz, Produktentwicklung und weiteren internen Fachbereichen Qualifications - Ausbildung: Abgeschlossenes Studium im Bereich IT, Informationssicherheit oder eine vergleichbare Qualifikation - Erfahrung: Mehrjährige praktische Erfahrung im Aufbau und Management von ISMS, idealerweise in einer beratenden Rolle - Normenkenntnis: Tiefgehendes Verständnis relevanter Standards wie ISO/IEC 27001, NIS-2, BSI IT-Grundschutz und TISAX - Zertifizierungen: Wünschenswert sind anerkannte Qualifikationen wie ISO/IEC 27001 Lead Implementer, CISM oder CISSP - Arbeitsweise & Kommunikation: Analytisches Denken, strukturierte Herangehensweise und sicheres Auftreten im Kundenkontakt - Sprachkenntnisse: Sehr gute Deutschkenntnisse sowie verhandlungssicheres Englisch in Wort und Schrift - Reisebereitschaft: gelegentlich Benefits - Flexibles und hybrides Arbeitsmodell - Remote möglich! - Wettbewerbsfähiges Gehalt, Firmenfitness mit Wellpass und attraktive Mitarbeiterrabatte - 28 Urlaubstage und Workation-Möglichkeit - 1.000 € jährliches Weiterbildungsbudget für deine persönliche Entwicklung - Sinnstiftende Mission & Raum für Mitgestaltung und kreative Entfaltung - Regelmäßige Team- und Company-Events für echten Zusammenhalt - Modernes Office mit Ergonomie, Massagen, Snacks & Drinks

• Own all aspects of the Physical Protection System (PPS), with Genetec Security Centre (access control and VMS) as the primary platform — including configuration, maintenance, troubleshooting, and optimization across a multi-site enterprise architecture. • Serve as the first point of contact for PPS troubleshooting, conducting root cause analysis and driving defect resolution in partnership with our security integrator and internal IT. • Oversee and manage the Wealthsimple security integrator relationship, holding vendors accountable to SLAs and quality standards. • Lead technical planning, testing, and implementation of new security technologies and system integrations, managing projects from scoping through delivery. • Work with IT/Security teams to improve the existing and future integrations with our IdP, ensuring user onboarding and offboarding is automated correctly and user audits can be done by our IT and Compliance teams. • Develop and maintain complete technical documentation and controls, system audits, and infrastructure records in partnership with internal and external stakeholders. • Organize and lead annual penetration testing exercises and oversee remediation of identified vulnerabilities. • Manage access control credentials and site access programs. • Develop and lead training, as well as the creation of technical policies and procedures.

• Lead our security and privacy efforts and protect the students, educators, and partners who use the platform. • Drive the security engineering, compliance, and privacy programs forward with end-to-end ownership of risk and customer assurance. • Promote effective and thoughtful decision making to reduce uncertainty and increase organizational velocity. • Stand up SIEM and detection engineering pipelines to alert on and investigate anomalies before they turn into incidents. • Standardize and enforce RBAC on critical systems, including non-human and AI agent identities. • Add LLM-assisted and highly contextual code analysis to security-relevant pull requests, addressing tenant isolation and prompt injection threats. • Design data de-identification and isolation approaches for privacy-by-design use cases. • Keep an up-to-date risk register and security roadmap, communicating clearly through regular updates. • Support engineering team with secure design reviews that provide actionable and tradeoff-informed recommendations. • Equip customer-facing teams with top-notch trust center content, including security knowledge bases and customer assurance collateral. • Lead SOC 2 compliance operations and audits to reduce overhead on engineering and support teams. • Lead the incident response function to ensure rapid recovery capabilities. • Partner with Trust and Safety on child safety and responsible AI deployments. • Work cross-functionally to build partnerships instead of roadblocks.

• Own FedRAMP and GovRAMP (formerly StateRAMP) certifications and roadmaps: Lead the overall strategy for obtaining and maintaining federal authorizations, including package management, compliance timelines, and authority coordination. • Manage 3PAO relationships and assessments: Work with accredited third-party assessment organizations to conduct initial assessments and annual re-assessments. Coordinate scoping, evidence preparation, testing coordination, and results validation. • Lead continuous monitoring (ConMon) execution: Oversee the delivery of monthly, annual, and event-driven FedRAMP deliverables including vulnerability scans, penetration testing, system security plan updates, and compliance reporting. • Manage Plans of Action and Milestones (POA&M) processes: Own the identification, prioritization, tracking, and remediation of findings. Ensure timely closure of Critical (30 days), High (30 days), and Moderate (90 days) findings while coordinating with engineering and security teams. • Coordinate significant change requests and system modifications: Work with product and engineering to document, scope, assess, and obtain agency approval for system changes that impact security controls or compliance posture. • Engage with authorizing officials and federal agencies: Build and maintain relationships with government sponsors, CIOs, and agency decision-makers. Provide regular status updates, respond to questions, and demonstrate authorization compliance. • Prepare comprehensive assessment packages: Lead the development of System Security Plans (SSP), Security Assessment Plans (SAP), risk exposure tables, and supporting documentation required for audits. • Drive compliance automation and efficiency: Identify opportunities to automate evidence collection, simplify reporting, and reduce manual effort while maintaining rigor and auditability.