d) - Ownership in Open Finance

Qwist Group•Berlin, IL

18d•Hybrid

About The Position

As an Information Security Manager, you will be responsible for managing information security and ICT risk, driving its development and implementation. You will own the ISMS under ISO 27001 and hold the ICT Risk Management Function under DORA, covering aspects from risk assessment to ICT incident classification and third-party risk oversight. This role involves close collaboration with Engineering and Platform teams to integrate security into development processes and serves as the central point of contact for audits. The position reports directly to the Management Board and works closely with the Chief Legal Officer. The company is seeking individuals who take ownership and are eager to grow.

Requirements

A degree in information security, computer science, law/compliance or a comparable qualification, plus relevant professional experience in information security and ICT risk management
Solid hands-on experience operating an ISO 27001 ISMS, including ownership of documentation, controls and compliance activities
Experience working directly with software engineering, product or DevOps teams in a technology-led environment
Knowledge of DORA, and first practical exposure to MaRisk or comparable frameworks (NIS2, BAIT/KAIT) is explicitly welcome
A strong hands-on mentality, analytical thinking, and the ability to manage multiple topics and stakeholders in a dynamic environment
Confident communication in German and English, with both technical and non-technical audiences

Nice To Haves

We'll support you in becoming an expert in DORA, MaRisk, NIS2, BAIT/KAIT.

Responsibilities

Hold the ICT Risk Management Function under DORA Art. 6(4), maintain the ICT risk framework and the information register, and classify ICT-related incidents including timely reporting.
Develop the ISMS in line with ISO 27001 Annex A, define baseline controls and run continuous maturity assessments – including preparing and steering certification and surveillance audits.
Own audit evidence for DORA and ISO 27001 topics, run internal self-audits, and coordinate with external audit partners and internal audit.
Work closely with Software Engineering, Platform and DevOps to embed security and compliance requirements into development processes in a practical way.
Support business continuity and disaster recovery planning together with Platform and Engineering, including annual continuity testing for time-critical processes.
Assess and classify new ICT services under DORA Art. 28–30, review contractual requirements, and oversee the risk posed by ICT third parties.
Initiate penetration tests, run security incident response from triage through post-incident review, and strengthen security awareness across the company through training and workshops.