IT Security Project Manager

Quick Facts

• Focus: Patch- and vulnerability-management projects aligned with ISMS requirements
• Collaboration: IT operations, security governance, and cross-functional engineering teams

Description

You will lead complex IT security initiatives at the intersection of agility and security, with a strong focus on patch and vulnerability management. The role includes evolving organization-wide frameworks, defining SLAs/KPIs and risk tolerances, and driving improvements to patch/deployment maturity. You will provide regular reporting to CISO, IT leadership, and risk management and ensure audit-ready evidence is collected.

Responsibilities

• Evolve the company-wide patch and vulnerability-management framework in line with ISMS requirements
• Define and enforce SLAs, KPIs, and risk tolerances for vulnerability remediation across system landscapes
• Develop security policies, standards, and exception-management processes
• Create, prioritize, and steer a transparent patch-management roadmap
• Lead strategic security initiatives to improve patch and deployment cycle maturity
• Track implementation status and provide regular reporting to CISO, IT leadership, and risk management
• Collaborate with system and network administrators, cloud architects, DevOps, and business application owners to implement security requirements pragmatically
• Moderate conflicts between IT availability/operations and regulatory patch timelines
• Map and document patch processes to meet regulatory requirements (e.g., audit readiness and evidence collection for certifications)

Requirements

• Degree in (Business) Informatics, Cyber Security, Information Security, or comparable qualification plus solid work experience
• Several years of experience leading complex IT security projects or working as Project/Program Manager between IT operations and security governance
• Practical knowledge of security standards such as ISO/IEC 27001, BSI IT-Grundschutz, or NIST CSF / SP 800-40
• Ideally practical experience as an information security officer (ISB/CISO), ISMS auditor, or similar governance role
• Relevant certifications are a plus (e.g., CISM, CISSP, CRISC, ISO 27001 Lead Implementer/Auditor)
• Strong technical understanding of patch and vulnerability-management strategies (risk-based vulnerability management, zero-day handling, deployment approaches)
• Solid understanding of core IT infrastructure: Windows Server, Linux distributions, virtualization, network components, cloud platforms, and container technologies
• Excellent moderation and communication skills to translate technical risk for management and engage operational teams
• Fluent German and English (written and spoken)