Principal Information Security Manager

In this role you advance Staffbase’s information security program to investor-ready, AI-efficient governance at scale. You own the function day-to-day within the Finance & Operations team, coordinating across Legal, Procurement, Engineering, auditors and enterprise customers. You design scalable security workflows, automate where possible, and lead the program through audits, due diligence, and customer reviews. This is a maturity step that reduces manual effort and strengthens trust with partners and investors.

• Competitive compensation with LTIP
• Flexible working time models with hybrid option
• flex work allowance 1560 EUR
• 31 vacation days incl. floating holiday
• fully paid Fridays off during August
• company pension scheme

• Lead ISO 27001 and SOC 2 audit cycles end-to-end, including evidence collection, auditor management, and remediation
• Own and maintain the security control framework and ensure it evolves with the business
• Prepare the InfoSec program for investor and M&A due diligence
• Manage responses to enterprise customer security questionnaires and RFPs
• Represent Staffbase credibly in security reviews, calls, and audits
• Develop scalable automation, templates, and knowledge base to speed up security responses
• Maintain the risk register and drive risk treatments with stakeholders
• Oversee vendor security assessments for critical/high-risk suppliers and coordinate with Legal and Procurement on AI-assisted reviews
• Own the internal security policy framework and run security awareness programs
• Own the incident response plan and lead post-incident reviews with cross-functional teams

• 5+ years of hands-on InfoSec experience in a SaaS or B2B tech company
• Proven ownership of ISO 27001 and/or SOC 2 programs
• Experience representing InfoSec to enterprise customers, including security reviews and escalations
• Fluency in German and English
• Comfort with AI-driven tooling and automation opportunities in compliance and operations

• cross-functional collaboration
• stakeholder management
• clear communication with customers and auditors
• ISO 27001 and SOC 2 program management
• risk management and risk register maintenance
• vendor security assessments