About the Position

Information Security Manager - Risk Management (m/w/d)

Location: Germering, Germany

Type: Full-time, Permanent

About Us

At DocuWare, you will be part of globally distributed, international teams with flat hierarchies and an open company culture that invites you to participate in shaping the company. Mobile work and flexible working hours are part of our everyday life. Do you want to become part of an innovative company whose solution digitizes the working day in various industries? Then join our team!

Why Us?

DocuWare offers a variety of benefits:

Globally Distributed, International Teams: You will find us in Germering, New York, Sofia, and many other locations.
Flexible Work Location and Hours: Work remotely or in our modern, well-equipped office, with flexible scheduling.
Individual Development: After an intensive onboarding, you will receive regular tailored training (e.g., conferences, internal team-building activities).
Well-deserved Relaxation: In addition to 35 vacation days per year, we offer a wide range of sports and massage services, a table soccer table, and a relaxing lounge area.
Healthy Nutrition: Enjoy Fairtrade coffee with organic milk or oat drink, snacks, and fresh fruit – all for free – as well as subsidized lunch from the Foodji refrigerator.
Team Spirit: Regular events for employees - virtually or on-site - ensure cohesion.
Sustainability and Social Responsibility: DocuWare stands for paperless work and supports volunteer organizations and local sports clubs.
Easy Accessibility: Come to the office with your leased e-bike (Jobrad), by S-Bahn, or via the A96/A99 highways (you can charge your e-car on-site for free).
You Plan Ahead & We Support You: DocuWare subsidizes your occupational pension scheme!
Stable Job: In our long-established and continuously growing company, you will receive an indefinite permanent contract.
Latest Technologies: Learn more on Stackshare!
Unique Benefits: Choose one of three great options (Bonago, E-Gym, or Germany Ticket) according to your needs.
30 Days Work from Abroad: Gain international experience and broaden your horizons.
Family First: Priority registration at our selected daycare center in Germering (no guarantee).
Buddy Program: You will receive a buddy who will make your onboarding easier and support you during your first weeks at DocuWare.

For more insights, feel free to visit our Instagram!

Responsibilities

As an Information Security Manager - Risk Management (m/w/d), you will be responsible for our information security risk management from the first report of an incident to the quarterly risk report to our C-Level. You will work with our own scenario-based, quantitative security risk method. Additionally, you will be responsible for the information security aspect of our third-party risk management and support your colleagues in the internal control framework and audits.

Your tasks include:

Being part of our Information Security & BCM Organization (CISO area) and the central contact person for security risks - including from the supply chain.
Evaluating incoming reports, moderating the formulation of risk scenarios with the Risk Owners, and leading estimation workshops with Cloud Operations, Engineering, Legal, Data Protection, Sales, and Customer Success.
Estimating frequencies and damages, evaluating confidence, calculating the expected annual loss, and conducting plausibility checks. Ensuring that every number is consistent, comparable, and traceable.
Evaluating the efficiency of measures, preparing treatment and acceptance decisions, consolidating the risk portfolio quarterly, and jointly creating the report with the CISO to the C-Level.
Evaluating suppliers throughout their lifecycle - from defining the scope of audit over questionnaires, SOC-2 reports, and ISO certificates to contract requirements, security results, and annual re-evaluations - and linking the results with our risk portfolio.
Supporting your colleagues in maintaining our internal control framework and in internal and external audits such as ISO 27001 and SOC 2 Type 2, and answering customer inquiries from due diligence, RFPs, and questionnaires on risk management and supply chain security.
As a sparring partner of the CISO, you will further develop the risk methodology, train Risk Owners and Business Owners, and actively shape a risk culture in which risks are willingly reported.

Requirements

You have a degree in (Computer) Science, Business Administration, Information Security, or Risk Management, or a comparable qualification.
You bring several years of professional experience in information security, IT risk management, or GRC, and have already had practical responsibility for risk assessments, ideally at a SaaS, cloud, or software provider.
You conduct risk assessments independently, even in complex and novel cases, and enjoy moderating workshops with technical and functional stakeholders.
You have a good sense for numbers: Scenario-based and quantitative risk analysis (e.g., FAIR), three-point estimates, and cost-benefit considerations are familiar to you, and you can question an estimate for its order of magnitude.
You have a solid understanding of cloud and SaaS architectures, ideally Microsoft Azure, so that you can discuss attack paths and damage scenarios with engineers on an equal footing.
Additionally, a certification such as CRISC, CISM, CISSP, ISO 27005 Risk Manager, or Open FAIR, as well as experience with Jira, Confluence, or GRC tools, is advantageous.
Analytical thoroughness, sound judgment, and the ability to constructively question are your strengths. You work independently, take responsibility for your portfolio, and communicate risks clearly and honestly up to the C-Level.
You have fluent English skills, as you will work group-wide. German skills are advantageous.

Contact Person

Sarah Jagenow

Recruiting & Employer Branding Specialist

Our Address

Planegger Str. 1

82110 Germering

Information Security Manager - Risk Management (m/w/d)

Job description