Information Security Officer (m/f/d)

• We work in a non-hierarchical organization that empowers everyone to take responsibility, stay focused, and contribute directly to the company’s success and customer value.
• We value expertise and continuous professional development. Our professionals work closely with experienced colleagues, take ownership of their work, and continuously expand their skills.
• Openness and diversity are core to OX. Different perspectives, backgrounds, and ways of thinking strengthen our collaboration and help us see the bigger picture.

• We work in a non-hierarchical organization that empowers everyone to take responsibility, stay focused, and contribute directly to the company's success and customer value.
• We value expertise and continuous professional development. Our professionals work closely with experienced colleagues, take ownership of their work, and continuously expand their skills.
• Openness and diversity are core to OX. Different perspectives, backgrounds, and ways of thinking strengthen our collaboration and help us see the bigger picture.

Run the ISMS and ISO 27001

• Coordinate the identification and documentation of technical and organizational security measures across the OX Group, working with the responsible cells to keep documentation consistent, up to date, and traceable.
• Drive the continuous development of our ISMS by establishing sustainable governance structures, clear responsibilities, and aligned security processes and policies across the OX Group, ensuring their consistent application within our decentralized organization.
• Plan, coordinate, and support internal and external ISO 27001 audits as well as risk-based supplier assessments and audits. Coordinate the resolution of audit findings and track the implementation of agreed measures together with the responsible cells.

Make security work in a decentralized organization

• Harmonize security requirements and processes across different software landscapes, taking varying levels of maturity and risk profiles into account. Support operational cells with clear guidance, practical templates, and targeted advice, while operational ownership remains with the respective cells.
• Support product cells in identifying and assessing information security risks, document the assessment results within the ISMS, and recommend appropriate measures and risk-based priorities in close coordination with the relevant risk owners.
• Embed Security by Design across our product portfolio, working closely with DevSecOps and product cells to define security requirements and risk-based priorities early in the development process, including through joint information security sprints. Implementation and operation of security tooling remain with the responsible technical cells.

• Coordinate the assessment of relevant requirements arising from NIS2 and the Cyber Resilience Act (CRA) with the responsible functions and translate them into aligned security, evidence, and reporting processes, including clear responsibilities for operational implementation.
• Capture and negotiate customer information security requirements and align them with the relevant product cells and business functions.

• A degree in Computer Science, Business Information Systems, IT Security, or a comparable qualification, such as several years of relevant professional experience in information security, IT risk management, or IT compliance.
• Practical experience in establishing, implementing, and certifying an Information Security Management System (ISMS) in accordance with ISO 27001. Knowledge of the German BSI IT-Grundschutz framework is a plus.
• Experience assessing regulatory security requirements and translating them into practical technical and organizational requirements. Knowledge of NIS2 and the Cyber Resilience Act (CRA) is an advantage.
• Ideally, experience introducing or further developing cross-functional security processes in decentralized organizations with varying levels of technical and organizational maturity, combined with openness to working in an environment without traditional hierarchical structures.
• A solid understanding of software and cloud architectures, secure software development, and technical security measures, as well as experience working with engineering, architecture, and operations cells.
• A structured and analytical approach, combined with practical experience in assessing information security risks and deriving appropriate measures and priorities.
• Clear and convincing communication skills, strong subject-matter expertise, and the ability to explain complex topics in an accessible and audience-appropriate way, including to the Management Board. You are also able to assess customer information security requirements, represent them clearly, and coordinate them with product cells and customer-facing functions.
• Excellent written and spoken German and English.

• The flexibility to work 100% remotely ensures a work environment that suits you best.
• Flexible working hours that allow you to successfully combine your home and family responsibilities with work.
• Getting together in-person for workshops and fun team events.
• Time off to volunteer - and mental health support when you need it.
• We provide financial relief through corporate benefits and a subsidy for ergonomic chairs and desks.
• We can discuss further location-related benefits together in an initial talk.