IT Security Manager
Posted Updated
Operational Security and Control Ownership
- Own the vulnerability and patch management function for corporate IT
- Operate and ensure the effectiveness of technical security controls, including the provision of implementation evidence required for certification activities
- Manage identity and privileged access controls, including Conditional Access and Privileged Identity Management (PIM), and provide technical support for periodic access reviews
- Manage and oversee the performance of the external SOC service provider
- Lead operational incident handling for corporate IT (analysis, containment, recovery, evidence preservation), including technical input for incident classification and for regulatory reporting obligations
- Support the Information Security Management System (ISMS) Manager with technical input, evidence and expertise in risk assessments, audits and incident follow-up
- Act as deputy of the ISMS Manager for the declaration of information security incidents and the handling of regulatory reporting obligations
Project and Architecture Support
- Establish the security infrastructure during the onboarding of a previously separate infrastructure
- Ensure appropriate security controls during the network setup for this previously separate entity, including network segmentation, access control and third-country connectivity
- Support the migration of server workloads (external rack-mounted workstations; external data center), including physical security, data center requirements, and capacity and availability requirements
- Provide technical security input for the review and assessment of new cloud-based services and products
- Degree in computer science, information security or a related field, or a comparable qualification
- Several years of hands-on experience in IT security operations, ideally in a regulated environment (e.g. healthtech, medtech)
- Solid experience with vulnerability and patch management processes and tooling
- Strong knowledge of the Microsoft security stack, in particular Entra ID (Conditional Access, PIM), Defender XDR and Intune
- Experience in incident response, including analysis, containment, recovery and forensic evidence preservation
- Experience working with or steering an external SOC / MDR provider
- Solid understanding of network security, including segmentation and secure connectivity across international sites, ideally gained in infrastructure integration or migration projects
- Familiarity with ISMS frameworks and certifications (e.g. ISO 27001, SOC 2) and with regulatory reporting obligations (e.g. NIS2, GDPR)
- Knowledge of data center and physical security requirements is a plus
- Structured, hands-on and reliable working style; ability to translate technical topics for non-technical stakeholders
- Fluent English; German is a plus
Nice to have
- Certifications such as CISSP, CISM or Microsoft SC-200 / SC-300
- Experience in security assessments of cloud services and SaaS products
- Background in medical technology or healthcare software environments
- A supportive, international team connected by shared values and a culture of trust
- Meaningful responsibilities with a lasting impact on global healthtech, improving medical decisions and patient outcomes
- 30 vacation days, plus December 24th and December 31st
- Flexible working hours and a hybrid work model within Germany
- Bike leasing via our partner “BikeLeasing”
- Parking garage and secure underground bike storage
- Subsidized company restaurant and in-house café
- Urban Sports Club membership with employer contribution
- Regular after-work, team, and company events
- Centrally located, modern workspace with a 212 m² rooftop terrace