IT Security Manager

Operational Security and Control Ownership

• Own the vulnerability and patch management function for corporate IT

• Operate and ensure the effectiveness of technical security controls, including the provision of implementation evidence required for certification activities

• Manage identity and privileged access controls, including Conditional Access and Privileged Identity Management (PIM), and provide technical support for periodic access reviews

• Manage and oversee the performance of the external SOC service provider

• Lead operational incident handling for corporate IT (analysis, containment, recovery, evidence preservation), including technical input for incident classification and for regulatory reporting obligations

• Support the Information Security Management System (ISMS) Manager with technical input, evidence and expertise in risk assessments, audits and incident follow-up

• Act as deputy of the ISMS Manager for the declaration of information security incidents and the handling of regulatory reporting obligations

Project and Architecture Support

• Establish the security infrastructure during the onboarding of a previously separate infrastructure

• Ensure appropriate security controls during the network setup for this previously separate entity, including network segmentation, access control and third-country connectivity

• Support the migration of server workloads (external rack-mounted workstations; external data center), including physical security, data center requirements, and capacity and availability requirements

• Provide technical security input for the review and assessment of new cloud-based services and products

• Degree in computer science, information security or a related field, or a comparable qualification

• Several years of hands-on experience in IT security operations, ideally in a regulated environment (e.g. healthtech, medtech)

• Solid experience with vulnerability and patch management processes and tooling

• Strong knowledge of the Microsoft security stack, in particular Entra ID (Conditional Access, PIM), Defender XDR and Intune

• Experience in incident response, including analysis, containment, recovery and forensic evidence preservation

• Experience working with or steering an external SOC / MDR provider

• Solid understanding of network security, including segmentation and secure connectivity across international sites, ideally gained in infrastructure integration or migration projects

• Familiarity with ISMS frameworks and certifications (e.g. ISO 27001, SOC 2) and with regulatory reporting obligations (e.g. NIS2, GDPR)

• Knowledge of data center and physical security requirements is a plus

• Structured, hands-on and reliable working style; ability to translate technical topics for non-technical stakeholders

• Fluent English; German is a plus

Nice to have

• Certifications such as CISSP, CISM or Microsoft SC-200 / SC-300

• Experience in security assessments of cloud services and SaaS products

• Background in medical technology or healthcare software environments

• A supportive, international team connected by shared values and a culture of trust
• Meaningful responsibilities with a lasting impact on global healthtech, improving medical decisions and patient outcomes
• 30 vacation days, plus December 24th and December 31st
• Flexible working hours and a hybrid work model within Germany
• Bike leasing via our partner “BikeLeasing”
• Parking garage and secure underground bike storage
• Subsidized company restaurant and in-house café
• Urban Sports Club membership with employer contribution
• Regular after-work, team, and company events
• Centrally located, modern workspace with a 212 m² rooftop terrace