AI & SDLC Risk Manager (f/m/d)

About the Position

We are seeking an AI & SDLC Risk Manager (f/m/d) to join Deutsche Börse Group, one of the world’s leading financial market infrastructures. In this role, you will be part of Group ICT Risk, acting as the second line of defence, overseeing ICT risks across the organization. Your primary responsibility will be to assess and challenge the security of AI systems and software development pipelines, translating your engineering background into risk-relevant insights that protect critical market infrastructure.

Responsibilities

• Drive the resilience strategy operationally, including Shift Left (security embedded in development), Shift Down (platform security, OSCAL, infrastructure-as-code, Terraform), and Shield Right (vulnerability management, patching, 1D1D), in close collaboration with the Head of ICT Risk.
• Assess AI and Cloud systems deployed in trading, clearing, and risk environments for AI-specific risks such as adversarial ML, prompt injection, data poisoning, and uncontrolled agent behavior, and prepare content for management and supervisory bodies.
• Evaluate the maturity of the Secure Software Development Lifecycle (SSDLC) against IEC 62443-4-1 and the Cyber Resilience Act, and challenge security controls in CI/CD pipelines (SAST, DAST, SCA, container scanning) from an independent second-line perspective.
• Support the SQUARE initiative (Post-Quantum Cryptography) with technical assessments: crypto inventory, evaluation of NIST PQC standards (ML-KEM, ML-DSA, SLH-DSA), and migration readiness of systems and pipelines.
• Conduct DORA-compliant application risk assessments and manage observation tracking and remediation follow-up with first-line teams.
• Support internal and regulatory audits (DORA, BaFin, internal audit) and contribute to EU AI Act implementation as a second-line function towards product teams and 1LoD.

Requirements

• Background in software engineering or computer science with hands-on experience in developing and shipping software.
• At least 2 years of professional experience in product delivery, DevOps, or a related engineering field, with a genuine interest in application security, cloud security, or secure development practices.
• Familiarity with security concepts through OWASP, CTF participation, open source security contributions, or hands-on use of security tooling (SAST/DAST, container security, SBOM).
• Ability to assess what is critical and what is not, even without a formal framework, and communicate findings clearly to both technical and non-technical audiences.
• Experience working in an agile environment like SCRUM, Kanban, or with OKRs.
• Knowledge of cloud security (preferably GCP or Azure), regulatory frameworks (DORA, EU AI Act, CRA), or security certifications (AWS/GCP Security, OSCP, or equivalent) is a plus.
• Proficiency in written and spoken English; German language skills are an asset.

We Offer

• Opportunity to work with a leading financial market infrastructure.
• Be part of a newly built unit operating at the intersection of technology, regulation, and capital markets.
• Collaborative work environment with the Group CISO and first-line engineering teams.

About the Company

Deutsche Börse Group is a global leader in financial market infrastructure, providing critical services to the financial industry. Our commitment to innovation and excellence drives us to protect our market infrastructure through robust risk management practices.

Apply now to join our team and make a significant impact on the security of our market infrastructure.