Sobre el puesto
Permanent consulting role for financial-sector clients who have to prove their resilience, not just claim it. You review policies and controls, judge what a proposed change does to operational and cyber risk, and help stand up the controls and tooling that make a recovery story credible. AI drafts the assessments; you own the verdict.
Responsabilidades
- Review information security policies, controls and change requests, and say plainly which ones do not hold
- Assess what a proposed change does to operational and cyber risk before it ships, not after
- Support the implementation and day-to-day running of security and resilience controls and tooling
- Plan and risk-manage threat-led penetration testing, including engagements run under the TIBER-EU framework
- Develop cyber resilience strategy and translate it into controls someone can actually operate
- Prepare the evidence and reporting that supervisors, auditors and boards ask for
- Advise client security, risk and audit stakeholders up to CISO and CRO level
La IA se encarga · Tú te encargas
La IA se encarga
Control mapping and gap tables · First-draft assessments and findings · Evidence collection and collation · Policy comparison against frameworks
Tú te encargas
Risk judgment and the final verdict · What gets escalated and what does not · Client trust at CISO level · Defensibility in front of a supervisor
Tu perfil
- Information security and cyber resilience in a regulated financial environment
- Policy and control assessment against recognised frameworks (ISO 27001, NIST CSF, BSI IT-Grundschutz)
- Operational and cyber risk analysis, including third-party and concentration risk
- Threat-led penetration testing: scoping, risk management and remediation follow-through
- Incident response, business continuity and recovery planning
- Comfortable writing for both engineers and boards, in English and German
Titulación
- 5+ years in information security, cyber resilience or technology risk, ideally in banking, insurance or market infrastructure
- Practical experience of a regulatory or supervisory review, and of closing the findings from one
- A recognised certification is an advantage (CISSP, CISM, CRISC, ISO 27001 Lead Auditor)
- Degree in computer science, information security or a comparable field, or equivalent experience
- German C1 or better plus fluent business English