Principal of Information Security (f/m/d)

In this role you will own the information security function end-to-end at a fast-growing AI-biotech company. You will shape the security program through ISO 27001 activities, risk governance, and external partnerships, while also handling day-to-day operations. You’ll collaborate with executives to align security with business goals, regulatory expectations, and product strategy. The role offers impact across enterprise, healthcare readiness, and data-intensive imaging initiatives, at a pivotal stage of stabilization and growth.

• Stock Options
• Relocation Support
• Learning & Development budget
• Fitness Membership
• Childcare Reimbursement
• Deutschland Ticket (public transport)

• Lead the upcoming ISO 27001 re-audit and own its execution
• Define and maintain Orbem's information security strategy aligned with stage, customers, and risk appetite
• Own the information security risk register end-to-end and facilitate risk reviews with leadership
• Represent Orbem to auditors, enterprise security teams, and regulators as CISO
• Advise leadership on security risk impacting product, GTM, and expansion, including healthcare readiness planning
• Own and continuously improve key security processes across vendor risk, policy-to-control translation, and governance
• Manage ISMS governance including control reviews, evidence collection, and internal/external audits
• Lead incident response as incident commander with Security Engineering as technical co-lead
• Author security policies and communications to ensure clear, actionable guidance
• Orchestrate an external security stack and vendor ecosystem, including build-vs-buy decisions and ongoing relationships
• Collaborate with Security Engineering to connect governance and technical security, and build a Security Ambassadors network
• Leverage AI and automation to streamline compliance, vendor reviews, policy drafting, and training

• Scale-up security leadership experience (top‑tier compliance leadership in 150–600 FTE)
• ISO 27001 lived experience with practical audit strategy
• Hands-on operator with security process and control setup
• Comfort operating without a large team
• Resilience and decisive decision-making under pressure
• Strong communication translating risk to business and technical teams
• Experience with external providers for security and compliance
• Familiarity with AI-first security contexts and monitoring AI usage

• strategic thinking
• clear communication
• cross-functional collaboration
• ISO 27001 / ISMS governance
• incident response leadership
• vendor risk management