Governance, Risk & Compliance Expert

Responsibilities

• Support clients in defining and implementing their information security strategy
• Organize, structure, and manage security projects
• Implement and further develop Information Security Management Systems (ISMS)
• Develop and maintain security policies and processes (e.g., incident response, security policies)
• Analyze and assess security risks using established frameworks (e.g., ISO 27005, EBIOS RM)
• Identify and monitor operational, compliance, and security risks
• Define and implement security KPIs to measure security performance
• Support compliance with relevant cybersecurity and data protection regulations (e.g., NIS2, DORA, GDPR, NIST)
• Assess organizations' security posture and identify improvement measures
• Conduct internal audits and support compliance processes
• Coordinate incident response and assist with incident analysis
• Monitor remediation/action plans following incidents or audits and ensure their implementation
• Deliver training and awareness programs on information security and GRC policies
• Promote the adoption of security standards and best practices across organizations
• Contribute to our internal security community at CBTW and share knowledge and best practices with colleagues

Requirements

• Bachelor’s or Master’s degree in Cybersecurity, Information Security, or a comparable qualification
• At least 5 years of experience in a comparable role in Governance, Risk & Compliance or information security
• Solid knowledge of the ISO 2700x standards (ISO 27001, ISO 27002, ISO 27005)
• Experience with risk management methods such as EBIOS RM
• Knowledge of relevant regulatory requirements such as NIS2, DORA, or GDPR
• Experience implementing or improving an ISMS
• Strong analytical skills and a structured approach to work
• Fluent German and EnglishCertifications such as ISO 27001 Lead Implementer / Lead Auditor or ISO 27005 Risk Manager are advantageous
• Additional certifications such as CISM, CISSP, CRISC, or CISA are a plus
• Willingness to travel within the DACH region