Head of Information Security (Governance & Compliance)

Quick Facts

• Role: Head of Information Security (Governance & Compliance)

• Team/Line: 2nd line of defense

• Focus: ISMS governance, regulatory compliance, audit readiness, and independent oversight

Description

In this central leadership role in the CISO organization, you shape the information security strategy, develop the governance and compliance function, and strengthen resilience in times of cloud, AI, and DORA. You lead the 2nd line team, evolve the ISMS from a governance perspective, and ensure independent monitoring in close collaboration with IT (1st line) and internal audit (3rd line). You translate regulatory requirements into clear control mechanisms, manage audits, and provide decision-ready materials to top management.

Responsibilities

• Lead the information security team (2nd line), including disciplinary and functional management

• Develop and steer the ISMS from a governance and compliance perspective

• Ensure independent oversight of information security; coordinate closely with the 1st line (IT) and internal audit (3rd line)

• Define and continuously improve security policies, standards, and control mechanisms

• Own regulatory requirements including DORA, VAIT, and MaRisk: interpret them and derive resulting requirements

• Steer internal and external audits and ensure sustainable follow-up of findings

• Monitor regulatory developments and derive binding actions

• Advise management and business units as an independent governance/control function; create decision papers for the board and top management

Requirements

• Degree in (Business) Informatics or a related field

• Proven experience and demonstrated leadership in information security/cyber security with a Governance/Compliance focus (ideally 2nd line of defense)

• Strong knowledge of financial-sector regulatory requirements, especially DORA, VAIT, BAIT, and MaRisk

• Experience with audits and examinations by internal audit, external auditors, or regulators, and a solid understanding of the Three-Lines-of-Defense model

• Ability to prepare complex topics accurately and in a stakeholder-appropriate way up to top management level

• Strategic mindset, execution strength, and strong stakeholder management

• Fluent German and excellent English (spoken and written)

Benefits

• Flexible working hours

• 30 days of vacation

• Systematic skills development

• Regional, varied meals in company restaurants (including vegan options)