Group Information Security Manager
Orcrist Technologies
Salary undisclosed
Need a reasonable accommodation to apply or interview? Contact us.
JobMinglr uses automated technology to recommend jobs based on profile information and job preferences. Match Score does not determine eligibility for a position, prevent a user from viewing or applying to a job, or make hiring decisions on behalf of an employer.
Description
Orcrist is building a next generation data intelligence platform using cutting-edge technologies. We're handling petabyte-scale data with sub-second queries. Our product is a Kubernetes‑based platform delivered as B2B SaaS or as a self‑hosted on‑prem solution, including air‑gapped deployments. We enable customers across defense, law enforcement, and enterprise to turn mission-critical data into actionable intelligence.
Role
As Group ISB, you own the information security strategy, programme, and posture of the Vektor Group, from strategy to hands-on execution. You work in close operational partnership with the Director of Internal IT on technical controls and implementation. Your core mandate is ISO 27001 certification on the basis of BSI IT-Grundschutz, together with NIS-2 compliance: from gap analysis and controls implementation through audit readiness, ongoing maintenance, and the regulatory obligations arising under both frameworks.
We build AI platforms for customers in the defence and government sector. Information security is a precondition for our business, not an afterthought. We are building the security organisation while the group grows. During this phase, everyone including leadership works hands-on: day-to-day operational security, direct support for the IT team, and tasks outside the boundaries of a traditional governance role. External consultants support the ramp-up. As the ISMS and the team mature, the balance shifts toward strategy and governance.
What you'll do
- Build and operate the group-wide ISMS following BSI standards 200-1/200-2/200-3: structure analysis, protection needs assessment, modelling, risk analysis
- Create and maintain the security policy framework and processes at group level; coordinate company-specific additions
- Prepare and accompany ISO 27001 certification, run internal audits, work with external auditors
- Implement NIS-2 obligations: reporting processes, evidence management, corrective action tracking
- Manage risk across technical and organizational domains, including reporting to executive management
- Steer external consultants and service providers within the running programme
- Build and run the security awareness programme: training and sensitization
- Own incident response planning and coordinate during incidents, together with IT, Legal, and leadership
- Assess third-party and vendor risk, run security assessments for new tools and partners
- Work closely with the Director of Internal IT (technical controls: access governance, endpoint security, identity) and with platform engineering (interface to product security)
- Support sales and customer trust processes: security questionnaires, due diligence, customer audits
- Track further regulatory requirements (EU AI Act, Cyber Resilience Act, among others) and derive required action
About you
- Several years of experience as an ISB or in comparable responsibility for information security
- Proven practice with BSI IT-Grundschutz: BSI standards 200-x and the Grundschutz-Kompendium, ideally including a completed certification procedure
- Experience building or leading ISO 27001 programmes, from gap analysis to audit readiness
- Solid risk management: you assess, prioritize, and communicate risk clearly to technical and non-technical audiences
- Willingness to work hands-on during the build-up phase
- Confident interaction with executive management, auditors, and customers
- German at C1 or above, English at B2 or above
Nice-to-haves
- Certifications: IT-Grundschutz-Praktiker/-Berater, ISO 27001 Lead Implementer or Lead Auditor, CISSP, CISM
- Experience with security governance across multiple legal entities or jurisdictions
- Experience in regulated environments: defence, government, critical infrastructure; familiarity with VS-NfD, Geheimschutz, or AQAP
- Practical NIS-2 implementation experience
- Experience with sales-adjacent security processes (pre-sales, customer audits)
What we offer
- Remote-first, Germany-wide: Work from wherever you do your best work, with regular team gatherings in Berlin and other off-site locations.
- Flexibility by default: Flexible working hours help you make work fit your life.
- Your setup, your way: Get a personal home-office equipment budget to create a workspace that works for you.
- 30 days of vacation: Take the time you need to recharge and come back with fresh energy.
- Keep growing: We invest in your personal and professional development.
- Get rewarded for impact: Performance bonuses are tied to agreed objectives and key results.
- A warm welcome: Every new team member gets a welcome goodie bag.
- Good people, good times: From summer and Christmas parties to regular team gatherings, we make time to celebrate together.
- A mission that matters: Work on challenges with tangible impact on public safety and national security.
Benefits
- Remote-first, Germany-wide: Work from wherever you do your best work, with regular team gatherings in Berlin and other off-site locations.
- Flexibility by default: Flexible working hours help you make work fit your life.
- Your setup, your way: Get a personal home-office equipment budget to create a workspace that works for you.
- 30 days of vacation: Take the time you need to recharge and come back with fresh energy.
- Keep growing: We invest in your personal and professional development.
- Get rewarded for impact: Performance bonuses are tied to agreed objectives and key results.
- A warm welcome: Every new team member gets a welcome goodie bag.
- Good people, good times: From summer and Christmas parties to regular team gatherings, we make time to celebrate together.
- A mission that matters: Work on challenges with tangible impact on public safety and national security.
About this role
Orcrist Technologies is seeking a Group Information Security Manager to build and operate the information security management system for the Vektor Group from the ground up. You'll own the full security strategy and programme, from establishing BSI IT-Grundschutz-based controls and ISO 27001 certification through NIS-2 compliance, risk management, and ongoing regulatory obligations. This is a hands-on role during a critical growth phase: you'll work directly with the Director of Internal IT on technical implementation, coordinate with platform engineering, run internal audits, manage vendor assessments, and support customer trust processes alongside your governance responsibilities. As the security organization matures, the focus will shift more toward strategy, but right now the role demands operational involvement across technical and organizational domains.
You'll need several years of proven experience with BSI standards and ISO 27001 programmes, ideally including a completed certification. Strong risk management skills and the ability to communicate clearly with both technical teams and executive leadership are essential. German language proficiency at C1 level is required; English at B2 or above. Experience in regulated environments—particularly defence, government, or critical infrastructure—is valuable, as is hands-on familiarity with NIS-2 implementation and sales-adjacent security processes. Relevant certifications such as IT-Grundschutz-Praktiker, ISO 27001 Lead Implementer, or CISSP would strengthen your candidacy.
The position is fully remote across Germany with regular in-person gatherings in Berlin, flexible working hours, a personal home-office budget, 30 days of vacation, and performance bonuses tied to objectives. Orcrist invests in professional development and offers a mission centred on public safety and national security through its defence and government sector platform.
This role's local market on JobMinglr
Pay for this role
The employer didn't post a pay range for this role. That usually means pay is set in negotiation, which favors whoever arrives with numbers. Check ranges on comparable Group Information Security Manager postings in Berlin, and analyze any offer before you accept it.
Before you apply, worth reading
How JobMinglr reads this job
Every listing here is scored against your profile before you apply: skills overlap, experience level, location and work arrangement, each weighted and explained. You see the score and the reasons, not just a list. How the matching works.