Information Security Manager - Risk Management; m​/f​/d

Docu Ware stands for globally distributed, international teams and an open corporate culture that invites you to help shape it. Mobile Work and flexible working hours are part of our everyday life. Would you like to be part of an innovative company whose solutions are digitizing everyday work in a wide range of industries? In that case, we are happy to welcome you to the team.

As Information Security Manager – Risk Management (m/f/d), you will run our information security risk management end-to-end – from the first report of a concern to the quarterly risk report for our C-Level – based on our own scenario-based, quantitative Security Risk Method. In addition, you will be responsible for the information security part of our third-party risk management and support your colleagues with our internal control framework and audits.

Your responsibilities include:

• You are part of our Information Security & BCM organization (CISO area) and will be the go-to Person for security risk and supplier security risk across our group entities.
• You will triage reported concerns, moderate the framing of risk scenarios with Risk Owners, and lead estimation workshops with Cloud Operations, Engineering, Legal, Data Protection, Sales and Customer Success.
• You will estimate frequencies and losses, rate confidence, calculate the expected annual loss and run the plausibility checks – making sure every figure is consistent, comparable and traceable.
• You will assess the efficiency of treatments, prepare treatment and acceptance decisions, consolidate the risk portfolio quarterly and prepare the C-Level report together with the CISO.
• You will evaluate suppliers across the entire lifecycle – from scoping, questionnaires, SOC 2 reports and ISO certificates to contract requirements, the security result and annual reassessments – and link their findings to our risk portfolio.
• You will support your colleagues in maintaining our internal control framework and in internal and external audits such as ISO 27001 and SOC 2 Type 2, and answer customer due diligence, RFP and questionnaire requests on risk and supply chain security.
• As sparring partner to the CISO, you will help develop the risk methodology further, train Risk Owners and Business Owners, and actively shape a risk culture in which people are glad to report.

• You have a completed degree in (business) informatics, business administration, information security or risk management, or a comparable qualification.
• You have several years of professional experience in information security, IT risk management or GRC and had hands‑on responsibility for risk assessments, ideally with a SaaS, cloud or software provider.
• You run risk assessments independently, including complex and novel cases, and you enjoy moderating workshops with technical and business stakeholders.
• You are comfortable with numbers: scenario-based and quantitative risk analysis (e.g., FAIR), three-point estimates and cost-benefit considerations are familiar to you, and you can challenge an estimate on its order of magnitude.
• You bring a solid understanding of cloud and SaaS architectures, ideally Microsoft Azure, so that you can discuss attack paths and loss scenarios with engineers on equal footing.
• Additionally, a certification such as CRISC, CISM, CISSP, ISO 27005 Risk Manager or Open FAIR, as well as experience with Jira, Confluence or GRC tooling, is an advantage.
• You are characterized by analytical rigor, sound judgment and the ability to challenge constructively – you work independently, take ownership of your portfolio and communicate risks clearly and honestly, up to C-Level.
• You are business fluent in English as you will work across group…