Customer Information Security Manager (maternity cover)

We are looking for a Customer Information Security Manager to join our team at ARIS in Sofia, Bulgaria.
In this role, you will lead key activities across customer security assurance and third-party risk management, helping customers, prospects, and internal stakeholders understand ARIS’ security, privacy, compliance, and risk management practices.

You’ll work closely with teams across security, legal, sales, customer success, and engineering to support customer due diligence, supplier reviews, RFPs, renewals, and enterprise security requirements.

Essential Functions:

Lead responses to customer security questionnaires, vendor assessments, RFPs, and due diligence requests
Support customer security reviews for prospects, existing customers, renewals, and enterprise accounts
Participate in customer calls to explain security controls, compliance posture, and risk management practices
Manage third-party risk reviews for suppliers, vendors, and partners
Review supplier security documentation, certifications, policies, and risk responses
Track supplier risks, exceptions, follow-ups, and remediation actions
Maintain accurate customer-facing security documentation, standard responses, and supporting evidence
Respond to questions relating to security controls, certifications, subprocessors, data handling, access management, incident response, and business continuity
Partner with legal and internal stakeholders to review security-related contractual commitments
Identify opportunities to improve security assurance, documentation, and third-party risk processes

Minimum requirements:

Experience in information security, GRC, compliance, customer assurance, vendor risk, third-party risk management, or a related role
Experience managing customer security questionnaires, due diligence requests, and supplier risk assessments
Good working knowledge of frameworks and standards such as ISO 27001, SOC 2, GDPR, NIST, or similar
Ability to discuss SaaS/cloud security, access controls, encryption, vulnerability management, secure development, incident response, data retention, subprocessors, and supplier risk with confidence
Awareness of current customer expectations around AI, third-party tools, software supply chain risk, and data protection
Strong written and verbal communication skills, with the ability to engage both technical and non-technical stakeholders
Sound judgement, attention to detail, and the ability to manage competing priorities
Confidence working cross-functionally with security, legal, sales, customer success, and engineering teams

Nice to have:

Experience with Drata or similar compliance automation platforms
Experience in a SaaS, technology, or other cloud-based environment
Experience supporting ISO 27001, SOC 2, C5 or similar audits
Relevant security, risk, or audit certifications such as CISSP, CISM, CISA, ISO 27001 lead implementer/auditor, or similar
Experience improving security response libraries, trust documentation, or third-party risk management processes
Experience working with a customer-facing trust centers or security assurance portals

Benefits

25 working days' annual leave — 5 above the statutory minimum — rising with tenure through the loyalty programme
Supplementary private health insurance (Groupama) covering outpatient, hospital, dental, vision and preventive care, with family members addable
MultiSport card, co-funded by ARIS, for gyms and sports facilities nationwide
Monthly Edenred gift card
€700 one-time work-from-home allowance on joining
Hybrid working — up to 3 days from home per week — with a free secured office parking space