IT Security Manager

Operational Security and Control Ownership

• Own the vulnerability and patch management function for corporate IT
• Operate and ensure the effectiveness of technical security controls, including the provision of implementation evidence required for certification activities
• Manage identity and privileged access controls, including Conditional Access and Privileged Identity Management (PIM), and provide technical support for periodic access reviews
• Manage and oversee the performance of the external SOC service provider
• Lead operational incident handling for corporate IT (analysis, containment, recovery, evidence preservation), including technical input for incident classification and for regulatory reporting obligations
• Support the Information Security Management System (ISMS) Manager with technical input, evidence and expertise in risk assessments, audits and incident follow-up
• Act as deputy of the ISMS Manager for the declaration of information security incidents and the handling of regulatory reporting obligations

Project and Architecture Support

• Establish the security infrastructure during the onboarding of a previously separate infrastructure
• Ensure appropriate security controls during the network setup for this previously separate entity, including network segmentation, access control and third-country connectivity
• Support the migration of server workloads (external rack-mounted workstations; external data center), including physical security, data center requirements, and capacity and availability requirements
• Provide technical security input for the review and assessment of new cloud-based services and products

• Degree in computer science, information security or a related field, or a comparable qualification
• Several years of hands-on experience in IT security operations, ideally in a regulated environment (e.g. healthtech, medtech)
• Solid experience with vulnerability and patch management processes and tooling
• Strong knowledge of the Microsoft security stack, in particular Entra ID (Conditional Access, PIM), Defender XDR and Intune
• Experience in incident response, including analysis, containment, recovery and forensic evidence preservation
• Experience working with or steering an external SOC / MDR provider
• Solid understanding of network security, including segmentation and secure connectivity across international sites, ideally gained in infrastructure integration or migration projects
• Familiarity with ISMS frameworks and certifications (e.g. ISO 27001, SOC 2) and with regulatory reporting obligations (e.g. NIS2, GDPR)
• Knowledge of data center and physical security requirements is a plus
• Structured, hands-on and reliable working style; ability to translate technical topics for non-technical stakeholders
• Fluent English; German is a plus

• Certifications such as CISSP, CISM or Microsoft SC-200 / SC-300
• Experience in security assessments of cloud services and SaaS products
• Background in medical technology or healthcare software environments

• A supportive, international team connected by shared values and a culture of trust
• Meaningful responsibilities with a lasting impact on global healthtech, improving medical decisions and patient outcomes
• 30 vacation days, plus December 24th and December 31st
• Flexible working hours and a hybrid work model within Germany
• Bike leasing via our partner “BikeLeasing”
• Parking garage and secure underground bike storage
• Subsidized company restaurant and in-house café
• Urban Sports Club membership with employer contribution
• Regular after-work, team, and company events
• Centrally located, modern workspace with a 212 m² rooftop terrace