About the Position

We're seeking an Information Security Lead (m/f/d) to manage TeleClinic's security strategy, ensuring compliance with ISO 27001 and ISO 9001 in a regulated healthcare environment.

Responsibilities

Own our ISO 27001 certification end to end - surveillance audits, re-certification, scope changes, and closing findings with our external auditor (our ISMS runs in Vanta).
Coordinate with our ISO 9001 programme so both audit cycles run as one, and help shape what we certify next (e.g. BSI C5).
Run and evolve the ISMS day to day: risk register, control ownership, evidence collection, and the internal audit programme.
Define and implement security policies, standards, and procedures across and with all teams.
Lead risk assessments, threat modelling, and vulnerability management.
Own third-party and vendor risk, from due diligence through to ongoing review.
Monitor the threat landscape and proactively address emerging risks relevant to a regulated healthcare environment.
Collaborate with product teams and infrastructure on architecture decisions with a security-first mindset.
Educate and upskill colleagues on security awareness and best practices.
Contribute hands-on to our Python/Django services where security work calls for it (tooling, automation, remediation).

Requirements

Several years owning information security in a regulated or audited environment, including direct exposure to external auditors.
Hands-on experience with ISO 27001, ideally having led or significantly contributed to an implementation, re-certification, or surveillance cycle.
Solid understanding of network security, identity & access management, encryption, and secure SDLC.
Experience running third-party and vendor risk management.
Strong communicator who can translate complex security concepts to non-technical stakeholders.

Nice to Have

Experience operating within an integrated management system (ISO 27001 alongside ISO 9001 or similar) is a strong plus.
Familiarity with healthcare data regulations (GDPR, potentially HIPAA, or German digital health regulations such as DiGA) is a strong plus.
Proven track record with cloud infrastructure (AWS, GCP, or Azure) and modern DevSecOps practices is a plus.
Python backend engineering experience is a plus.
Fluent in English; German is a plus.

We Offer

Remote first: You can work from anywhere in Europe or from countries with a maximum time difference of 2 hours to Germany.
Workation: Twice a year you can also work outside Europe for up to 3 weeks.
Employer of Record: If you work outside of Germany, you will be hired through an Employer of Record who will take care of all legal matters and payroll.
Co-working week: During this week, all employees come together twice a year at an inspiring location to work together, exchange ideas and simply have a good time.
Urban Sports Club Membership Discount
30 days vacation per year
Access to eLearning platforms such as LinkedIn Learning or Reforge
Shopping discounts through Corporate Benefits
Mobility discounts: Jobrad & Finn.auto
Opportunity to participate in the employee participation program (stock options)
Company pension scheme with attractive employer contributions
Up to 1.000€ in personal development budget & 2 days off for personal development

About the Company

TeleClinic GmbH is dedicated to innovating healthcare for the better. Join our team and contribute to making a significant impact in the healthcare industry.

Application Process

First contact: Our recruiting team will review your profile and invite you for an initial chat.
Interview: Meet your potential future manager to get to know each other.
Practical case: Depending on the role, you may receive a test, coding challenge, or business case.
Team meeting: Meet your future team to discuss your practical case and team dynamics.
Management Interview: Final interview with the C-level team focusing on mindset and cultural fit.

Contact

Your contact person is Philipp Setiahardja. Send an email to apply.

Apply now

Information Security Lead (m/f/d)

Job description