Head of Information Security (Governance & Compliance)

Quick Facts

• Role: Head of Information Security (Governance & Compliance)

• Focus: 2nd line governance/compliance, ISMS steering, regulatory requirements, audit readiness

• Collaboration: 1st line (IT), 2nd line team leadership, 3rd line (Internal Audit)

Description

In this central leadership role in the CISO area, you shape information security from an independent governance perspective and strengthen resilience in the context of cloud, AI, and DORA. You develop and lead the information security team (2nd line), serve as a key contact for management, and contribute directly to the organization’s security strategy together with the board and central steering functions.

Responsibilities

• Lead the information security team (technical and disciplinary leadership, 2nd line)

• Develop and steer the ISMS from a governance and compliance perspective

• Ensure independent monitoring of information security (2nd line) and work closely with IT (1st line) and Internal Audit (3rd line)

• Define and further develop security policies, standards, and control mechanisms

• Own regulatory requirements (DORA, VAIT, MaRisk), including interpretation and deriving actionable requirements

• Manage and support internal and external audits/inspections; ensure sustainable tracking, follow-up, and closure of findings

• Monitor regulatory developments and derive binding measures

• Advise management and business functions as an independent control and governance unit; prepare decision materials for the board and top management

Requirements

• Degree in (Business) Informatics or a related field

• Proven experience and leadership experience in information security/cyber security with a governance/compliance focus (ideally 2nd line of defense)

• In-depth knowledge of financial-sector regulatory requirements, especially DORA, VAIT, BAIT, and MaRisk

• Experience supporting audits and inspections by internal audit, external auditors, and regulators; understanding of the Three Lines of Defense model

• Ability to prepare complex topics clearly for top management

• Strategic thinking, strong implementation capability, and stakeholder management skills

• Fluent German and very good English (written and spoken)

Benefits

• Flexible working hours

• 30 vacation days

• Systematic competence development

• On-site dining with regional, varied meals and vegan alternatives