Information Security Consultant (w/m/d)
Permanent Employment, Experienced Position - Germany (all Cities)-- automatic translation --
We are looking for an Information Security Consultant (f/m/d) for one of our locations throughout Germany as soon as possible
Your tasks
As an Information Security Consultant, you will be the central contact person and technical advisor to our customers in matters of information and IT security. You will combine the individual security requirements of our customers with the technical, organizational and operational possibilities of our security services.
In doing so, you will take a holistic view of information security, identify risks and potential for improvement, and develop suitable, practice-oriented solutions together with our customers. You will advise on the implementation of regulatory requirements, recognized security standards and proven industry practices and accompany the further development of security measures and security services.
In addition, you will actively participate in the professional development of our security consulting portfolio.
Customer advice and information security
Interface between customer requirements and security services
Security Governance, Risk & Compliance
Development and further development of security consulting services
In doing so, you will take a holistic view of information security, identify risks and potential for improvement, and develop suitable, practice-oriented solutions together with our customers. You will advise on the implementation of regulatory requirements, recognized security standards and proven industry practices and accompany the further development of security measures and security services.
In addition, you will actively participate in the professional development of our security consulting portfolio.
Customer advice and information security
- Independent technical support and advice to medium-sized and large customers on organizational, technical and regulatory issues of information security.
- Establish and maintain trusting relationships with our customers´ information security officers, IT management, and technical contacts.
- Analysis and evaluation of existing security organizations, IT architectures, security measures and security services with regard to their effectiveness, risks and potential for improvement.
- Identification of safety requirements and need for action as well as development of suitable, prioritized and economically appropriate measures.
- Advice on the implementation of relevant regulatory requirements, security standards and established best practices, taking into account the individual customer environment.
- Development and evaluation of security concepts, risk and protection needs analyses, action plans and security roadmaps.
- Expert support of safety initiatives and improvement measures in cooperation with the responsible technical and organizational managers.
Interface between customer requirements and security services
- Translation of professional, technical and regulatory security requirements into concrete security measures and implementable security services.
- Assess the performance of existing security services in light of current and future customer requirements.
- Identification of deviations, functional gaps and optimization potentials as well as development of suitable solution and improvement approaches.
- Professional coordination and coordination between customers, security operations, technical teams, service management and external partners.
- Support in the further development of existing security services in terms of effectiveness, quality, cost-effectiveness and regulatory compliance.
- Technical assessment of security risks, critical deviations and escalations as well as support in the derivation of suitable measures.
- Participation in regular customer and service meetings as well as preparation and communication of safety-relevant findings, evaluations and recommendations for action.
Security Governance, Risk & Compliance
- Advice on relevant security standards, frameworks and regulatory requirements, in particular ISO/IEC 27001, BSI IT-Grundschutz, NIST Cybersecurity Framework, NIS2, DORA and GDPR, as far as applicable in the respective customer context.
- Implementation and support of security assessments, gap analyses, risk and protection needs analyses as well as maturity assessments.
- Support in the development and further development of safety guidelines, security concepts, control mechanisms and action plans.
- Assessment of regulatory and normative requirements with regard to their practical effects on IT architectures, security measures, processes and security services.
- Preparation and technical support of internal and external audits as well as support in the evaluation and processing of identified deviations.
- Development of appropriate and practicable recommendations for improving the level of safety, taking into account existing technical, organizational and economic framework conditions.
Development and further development of security consulting services
- Identification of security requirements, potential for improvement and technical consulting needs within the framework of existing customer relationships.
- Active participation in shaping and further developing our security consulting portfolio based on practical customer experience, technological developments and relevant security requirements.
- Conception of practice-oriented and standardizable consulting services, such as security assessments, gap analyses, security architecture reviews, governance consulting, security roadmaps and security improvement programs.
- Definition of service contents, deliverables, process models, required competencies, resources and prerequisites for new consulting services.
- Preparation of well-founded cost estimates as well as technical service descriptions as a basis for the design of offers and services.
- Development of reusable methods, standards, templates and quality criteria to ensure efficient and consistent service delivery.
- Technical support for sales, portfolio management and service management in the development and evaluation of security consulting services, without own acquisition or sales responsibility.
Your profile
Professional Qualifications
Personal skills
General requirements
- Several years of practical experience in information and IT security, ideally in an advisory role at an IT service provider, managed service provider or security consulting company.
- Broad and in-depth understanding of essential disciplines of information security, in particular security governance, risk management, compliance, security architecture and security operations.
- Good technical knowledge of modern IT infrastructures and security solutions, especially in the areas of network and cloud security, identity & access management, endpoint security, vulnerability management, security monitoring and incident management.
- Sound knowledge of relevant security standards and frameworks, in particular ISO/IEC 27001, BSI IT-Grundschutz, NIST Cybersecurity Framework or CIS Controls.
- Ability to classify regulatory requirements such as NIS2, DORA and GDPR in the respective customer context and to derive appropriate technical and organizational security measures from them.
- Experience in analyzing complex security requirements and translating them into realistic, prioritized, and commercially appropriate measures.
- Understanding of the organization and provision of IT and managed security services as well as the cooperation of different technical and organizational areas of responsibility.
- Experience in the creation of security concepts, assessments, risk analyses, action plans or comparable consulting services.
- Ability to design and structure consulting services in a technical manner, including service descriptions, effort estimation and definition of suitable results.
- Relevant certifications such as CISSP, CISM, ISO 27001 Lead Implementer/Lead Auditor or comparable qualifications are an advantage.
- Knowledge of IT service management, for example according to ITIL, is desirable.
Personal skills
- Strong analytical and conceptual skills as well as the ability to grasp complex technical and organizational relationships holistically.
- Customer-oriented, solution-oriented and entrepreneurial mindset with a strong understanding of feasible and economically appropriate security measures.
- Ability to constructively reconcile different requirements and interests between customers, security managers, technical teams and service management.
- Initiative in identifying potential for improvement and developing suitable solutions.
- Confident appearance as well as strong communication and consulting skills towards technical contacts, information security officers and management.
- Ability to communicate complex security requirements in an understandable way and to justify well-founded recommendations for action in a comprehensible manner.
- Independent, structured and responsible way of working.
- Openness to new technologies, security approaches and regulatory developments as well as interest in continuous professional development.
- Ability to work in a team and experience in working with interdisciplinary and international teams.
General requirements
- Degree in computer science, business informatics, information security or a comparable field of study or relevant vocational training with corresponding extensive practical experience and subject-specific further training.
- Very good knowledge of German as well as business-fluent English skills, both written and spoken.
- Willingness to make occasional business trips.
Why us?
- Attractive and performance-oriented compensation package
- Flexible working hours and extensive home office regulations
- Flat hierarchies and quick decisions
- Dynamic corporate development under new private equity investor
- Development opportunities in management or expert careers
- Innovative office workplaces and modern IT equipment
- Extensive further education and training opportunities
- Numerous corporate events and perks
Contact Information
Apply now!If you have any questions, feel free to contact:karriere@manage-now.de
ABOUT US
Manage Now is a leading IT service and managed services provider for enterprises and public institutions that want to strategically develop their IT while ensuring stable operations at the same time. With over 50 years of combined IT and project experience, we take responsibility for complex IT landscapes. In doing so, we combine consulting, operations, and transformation in an integrated approach, creating the foundation for IT that functions reliably while remaining controllable. Our integrated portfolio ranges from sovereign cloud and hybrid and multi-cloud to SAP and application management, as well as security and modern workplace environments, creating the foundation for IT that functions reliably while remaining controllable. Organizations can decide for themselves how much responsibility they want to hand over, from individual services to full end-to-end operational responsibility.